IA Charter and Mandate 1
Renfrewshire Council · 3 November 2025
Back to Audit, Risk and Scrutiny Board — 3 November 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 03 November 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Charter and Mandate ___________________________________________________________________ 1. Summary 1.1 The Internal Audit Charter was last updated in May 2023. 1.2 This report presents a revised Internal Audit Charter and Mandate (Appendix 1) that has been updated to take account of the new Global Internal Audit Standards in the UK Public Sector. 1.3 The main changes involve providing a fuller description of the work of the Internal Audit Service and the roles and responsibilities of the Chief Auditor within the Council and its associated Bodies and clarifying the mandate of the Internal Audit Service. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the revised Internal Audit Charter and Mandate. ___________________________________________________________________ Implications of the Report 1. Financial - None Public
Page 2
2. HR & Organisational Development – None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - Conformance with the Global Internal Audit Standards in the UK Public Sector mitigates the risk of the Internal Audit Service being ineffective. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author :- Karen Campbell, Chief Auditor Public
Page 3
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 A PURPOSE 1. INTRODUCTION The Internal Audit Section is an independent and objective assurance and advisory service designed to add value and improve the operations of Renfrewshire Council. It assists the Council in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes and enhances the Council’s decision making and oversight arrangements. It also provides internal audit services to the following Councils Associated Bodies and Partners detailed in Section F and will apply the same professional standards as defined in this Internal Audit Charter and Mandate to any work undertaken for these bodies. 2. MISSION To enhance and protect organisational value by providing independent risk-based and objective assurance, advice, insight and foresight. Internal Audit aims to enhance the organisation’s: • Successful achievement of its objectives, in support of its vision, values and priorities. • Governance, risk management, and internal control processes by championing good practice in governance. • Decision-making and oversight, by ensuring these are informed by the exposure to significant financial, strategic, reputational and operational risks to the achievement of the organisation’s strategic objectives. • Reputation and credibility with its stakeholders, as a contribution towards establishing and maintaining a culture of honesty, integrity, openness, accountability and transparency throughout the organisation in all its activities. • Ability to serve the public interest, by ensuring that the organisation and its members, employees and contracted third parties operate within the law and relevant regulations, and that that public money is safeguarded, properly accounted for, and used economically, efficiently and effectively. 3. DEFINITION OF ROLES For the purposes of the Internal Audit work function at Renfrewshire Council, the following roles are defined as: Public
Page 4
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 • the ‘board’ refers to the Audit, Risk and Scrutiny Board which has delegated responsibility for overseeing the work of Internal Audit; • ‘senior management’ is defined as the Council’s Corporate Management Team (CMT), all audit reports are issued to a member of the CMT; and • Chief Audit Executive’ refers to the Chief Auditor. 4. COMMITMENT TO ADHERING TO THE GLOBAL INTERNAL AUDIT STANDARDS IN THE UK PUBLIC SECTOR Renfrewshire Council’s Internal Audit Section will adhere to the Global Internal Audit Standards in the UK Public Sector and Topical Requirements and the CIPFA Code of Practice for the Governance of Internal Audit in Local Government. This mandatory guidance constitutes the principles of the fundamental requirements for the professional practice of internal auditing in the public sector and for evaluating the effectiveness of the internal audit activity’s performance. B MANDATE 1. REGULATION The Local Authority Accounts (Scotland) Regulations 2014 states that a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing. This is the mandate, alongside the Council’s Financial Regulations and Codes for the Internal Audit Section to operate within Renfrewshire Council. The recognised standards are the Global Internal Audit Standards in the UK Public Sector and the and the CIPFA Code of Practice for the Governance of Internal Audit in Local Government. 2. AUTHORITY The internal audit section’s authority is created by its direct reporting relationship to the Audit Risk and Scrutiny Board. Such authority allows for unrestricted access to this Board. Internal Audit has authorised full, free, and unrestricted access to any and all of the organisation’s functions, data, records, physical properties, and personnel pertinent to carrying out any engagement. It will allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques, and issue communications to accomplish the section’s objectives. Internal Audit can obtain assistance from necessary personnel and other specialised services from within or outside the organisation to complete internal audit services. Public
Page 5
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 Internal Audit will safeguard all information obtained in the carrying out of its duties and will only use it for the purposes of an audit, investigation, or consultancy work. Internal Audit will make no disclosure of any information held unless this is authorised or there is a legal or professional requirement to do so. All employees are requested to assist the internal audit activity in fulfilling its roles and responsibilities. The internal audit activity will also have free and unrestricted access to the Board and Senior Management. 3. ORGANISATION The Chief Auditor will report functionally to the Board and administratively (i.e. day to day operations) to the Director of Finance and Resources. The Director of Finance and Resources will approve the internal audit section’s human resources and administration budget. The Chief Auditor will communicate and interact directly with the Board, including in Board meetings and between Board meetings as appropriate. The Chief Auditor may report direct to the Chief Executive, Board members or the Council regarding any matters of concern that could place the Council in a position where the risks it faces are unacceptable or the independence of Internal Audit is under threat. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Board when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. C AUDIT COMMITTEE OVERSIGHT The Audit Risk and Scrutiny Board’s Terms of Reference are set out in the Council’s Scheme of Delegation and Financial Regulations and along with the Guidelines for the Operations of the Audit Risk and Scrutiny Board set out their responsibilities for the scrutiny of the Internal Audit Service. D CHIEF AUDITOR’S ROLES AND RESPONSIBILITIES 1. ETHICS AND PROFESSIONALISM The Chief Auditor will ensure that internal auditors: • Conform with the Global Internal Audit Standards in the UK Public Sector, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. Public
Page 6
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 • Adhere to the Council’s Employee Code of Conduct, including the Seven principles of Public Life and also to Renfrewshire Council’s relevant policies and procedures and the internal audit manual which sets out the internal audit activity’s standard operating procedures. • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the organisation. • Report organisational behaviour that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures 2. INDEPENDENCE AND OBJECTIVITY Internal Audit is an independent review activity. The Chief Auditor will ensure that in conducting its activities, Internal Audit remains free from any undue influence or other pressure affecting its actions and reporting. This includes matters of engagement selection, scope, procedures, frequency, timing, or report content. Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. It is the responsibility of Council’s managers to ensure that the management of the areas under their control is adequate and effective and that their services have a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. Internal auditors will have no direct operational responsibility or authority over any of the activities audited. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for Renfrewshire Council or its affiliates. • Initiating or approving transactions external to the internal audit function. • Directing the activities of any employee that is not employed by the internal audit section, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors. Public
Page 7
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 Where the Chief Auditor has responsibility for operational activities, the periodic review of these activities will be conducted by parties independent of the Internal Audit function. Internal auditors must exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. Internal auditors must make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments. They must take necessary precautions to avoid conflicts of interest, bias, and undue influence. Any impairments of independence or objectivity, in fact or appearance, will be disclosed to the Chief Auditor who will disclose the impairment to the appropriate parties. The Chief Auditor will confirm to the board, at least annually, the organisational independence and objectivity of the internal audit activity. 3. MANAGING THE INTERNAL AUDIT FUNCTION The Chief Auditor has the responsibility to: Internal Audit Plan • develop an Internal Audit Annual Plan based on a prioritisation of the audit universe using a risk-based methodology, including input of senior management and the Board. The internal audit plan will consist of a work schedule as well as resource requirements for the next financial year. • discuss the plan with the Board and senior management and submit the plan to the Board for review and approval. • communicate the impact of resource limitations on the Internal Audit Annual Plan to the Board and senior management • communicate progress of the plan and review and submit any changes to the associated Internal Audit Annual Plan, as necessary, in response to changes in the Council’s business, risks, operations, programmes, systems, and controls to the Board for approval through performance reports. Audit Engagements • ensure Internal Audit engagements are performed, documented, and communicated in accordance with the Global Internal Audit Standardsin the UK Public Sector and laws and/or regulations. Public
Page 8
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 • ensure that a written report will be prepared and issued by the Chief Auditor or designee following the conclusion of each internal audit engagement and distributed as appropriate. • ensure that the results of each internal audit engagement are also communicated to senior management and the Board. • ensure management provide Internal Audit with a response, detail of the corrective action taken or to be taken and the anticipated completion date in regard to the specific findings and recommendations. • follow up on engagement findings and confirm the implementation of recommendations or action plans and communicate the results of Internal Audit services to the Board and senior management at least annually. • report Management’s responses that the internal audit function determines may be unacceptable or where acceptance of a risk that is beyond the Council’s risk appetite. Knowledge and Skills • ensure the Internal Audit function collectively possesses or obtains the knowledge, skills, and other competencies and qualifications needed to meet the requirements of the Global Internal Audit Standards in the UK Public Sector and fulfill the Internal Audit mandate. • establish, regularly review and ensure adherence to methodologies designed to guide the Internal Audit function • ensure that a programme of Continuous Professional Development (CPD) is maintained for all staff working on audit engagements to ensure that auditors maintain and enhance their knowledge, skills and audit competencies. Other • identify and consider trends and emerging issues that could impact Renfrewshire Council and communicate to the Audit Risk and Scrutiny Board and senior management as appropriate. • coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the Chief Auditor cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary escalated to the Board. 4. PERIODIC ASSESSMENT The Chief Auditor will, report to senior management and the Board regularly on the internal audit activity’s purpose, authority, and responsibility, as well as performance Public
Page 9
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 relative to its plan. An annual report will also be provided and will contain an annual audit opinion on the overall adequacy and effectiveness of the Council’s internal control environment, and include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters needed to be brought to the attention of senior management and the Board. In addition, the Chief Auditor will communicate to senior management and the Board on the internal audit section’s quality assurance and improvement programme, including results of internal assessments and external assessments. External Quality Assessments (EQA) will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside Renfrewshire Council. The qualifications, knowledge and experience of at least one of the external assessors must be of those outlined for the Chief Audit Executive qualifications, knowledge and experience. E SCOPE AND RESPONSIBILITY OF INTERNAL AUDIT SECTION 1. INTERNAL AUDIT The scope of the internal audit section covers the entire breadth of the organisation, including all of its activities, assets, and personnel. The scope of internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives. This includes: • Independent review and appraisal of the control environment throughout the organisation. • Providing assurance to management and the Board that the established systems ensure compliance with those policies, plans, procedures, laws, and regulations which could have a significant impact on the organisation. • Evaluating the means of safeguarding assets and, as appropriate, verifying the existence of such assets. • Evaluating the effectiveness and efficiency with which resources are employed and evaluating that operations are being undertaken ethically and equitably. • Evaluating operations or projects to ascertain whether results are consistent with established objectives and goals and whether the operations or projects are being carried out as planned. • Evaluating the reliability and integrity of information and the means used to identify, measure, classify, and report such information. Public
Page 10
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 • Supporting the Council to improve its internal control, governance and risk management processes. • Evaluating the extent to which risks have been identified and managed to achieve the organisation’s objectives. • Encouraging a culture of personal and corporate responsibility and accountability through the promotion of anti-fraud and corruption and ethical values. • Having the right of access to examine the accounts and other financial records and data of external organisations as set out in the conditions of funding or other agreements. • Investigating any suspicion of fraud, irregularity or corrupt practice in accordance with the Council’s procedures including the Procedure for investigation of suspected irregularities involving employees within the course of their duties. 2. ADVISORY SERVICES Internal auditors may provide advice to an organisation’s stakeholders. The nature and scope of these services should be agreed with the client and are intended to add value and improve the organisation’s governance, risk management and control processes without the internal auditor providing assurance or assuming management responsibility. Examples include advising on the design and implementation of new policies and systems, facilitation of discussion on risks and controls and training. These services may be undertaken from time to time at the request of senior management. A provision is included in the annual audit plan for this type of work. When undertaking such work auditors will maintain their independence and objectivity and will not take on management responsibility for the project Any significant consultancy assignments will be reported separately to the Board. Any significant consulting exercise, not included in the annual audit plan, will be approved by the Audit, Risk and Scrutiny Board. Significant is defined as any single assignment equivalent to 5% of annual planned days. 3. OTHER WORK The Chief Auditor will: • co-ordinate the preparation of the Council’s Annual Governance Statement. • manage the Counter Fraud Service. • support the Chief Executive, the Director of Finance and Resources (Chief Financial Officer) and the Head of Corporate Governance (Monitoring Officer) in the discharge of their statutory duties. • with the agreement of the Board and Director of Finance and Resources, undertake other tasks provided there is no impairment to the independence and objectivity of the Internal Audit Service. Public
Page 11
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 • act as the Council’s Anti Money Laundering Reporting Officer and co-ordinate Whistleblowing Activities. F. PROVISION OF SERVICES TO ASSOCIATE/OTHER BODIES The Chief Auditor provides internal audit services to some associate bodies and partners of the Council and the principles of this Internal Audit Charter and Mandate apply to those associate bodies by means of a service level agreement between the Council and the body/partner: Associate Body Defined ‘Board’ Defined ‘Senior Management’ Renfrewshire Valuation Joint Board Joint Board Assessor and Electoral Registration Officer Scotland Excel Executive Sub- Committee Chief Executive Officer Partner Defined ‘Board’ Defined ‘Senior Management’ Renfrewshire Leisure Ltd Board of Directors Chief Executive The Chief Auditor is the appointed internal auditor for the Renfrewshire Integration Joint Board. Services are provided under the Internal Audit Charter and Mandate for that Board. The Chief Auditor may provide internal audit services to other organisations, on a commercial basis, if this is in the interests of Renfrewshire Council. G. APPROVAL AND AMENDMENT OF THE CHARTER AND MANDATE 1. APPROVAL The Internal Audit Charter and Mandate will be approved by the Board and shall be subject to regular review by the Chief Auditor in consultation with senior management. 2. AMENDMENTS Circumstances may justify a follow-up discussion between the Chief Auditor, and senior management on the mandate or other aspects of this Charter and Mandate. Such circumstances may include but are not limited to: Public
Page 12
INTERNAL AUDIT CHARTER & MANDATE Effective:03/11/2025 Review Date: 31/03/2027 • A significant change in the Global Internal Audit Standards in the UK Public Sector. • A significant reorganisation within the organisation. • Significant changes in the Chief Auditor and/or senior management • Significant changes to the organisation’s strategies, objectives, risk profile, or the environment in which the organisation operates. • New laws or regulations that may affect the nature and/or scope of internal audit services Public