Annual Internal Audit Plan 2026-27 complete
Renfrewshire Council · 16 March 2026
Back to Audit, Risk and Scrutiny Board — 16 March 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
PUBLIC ___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 16 March 2026 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Annual Internal Audit Plan 2026/2027 ___________________________________________________________________ 1. Summary 1.1 In line with the requirements of the Global Internal Audit Standards in the Public Sector, a risk based internal audit plan for 2026/27 has been developed. The audit plan takes into account the outcomes of internal corporate and service risk identification and evaluation processes, and the current business environment. In addition to undertaking work which will provide assurance on the robustness of key internal controls, the plan seeks to reflect the key priorities and challenges for the council. 1.2 A number of methods have been employed to facilitate production of the risk based audit plan for 2026/27: • Consultation with all Directors and their Senior Management Teams. • Consultation with senior management from the associate bodies. • Benchmarking with other Local Authorities. • Review of strategic, corporate and service risk registers. • Cumulative audit knowledge and experience. • Review of key external audit and inspection reports. 1.3 The total available resource is 1144 days, the operational audit time available for 2026/27 has been identified as 841 days (74%). The remaining 303 days (26%) relates to training, service development, administration and management. Coverage of the plan is achieved through the use of in-house staff and where relevant, commissions from other providers.
Page 2
PUBLIC 1.5 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. Non-operational time includes provision for training, performance management and service development. In addition to the internal audit assurance function the Interim Chief Auditor has managerial responsibility for risk management, insurance and corporate counter fraud which are excluded from the calculation of available operational audit resources. 1.6 Delivery of the risk based annual audit plan supports effective member scrutiny of the council’s internal financial and other control mechanisms. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the content of the risk based audit plan for 2026/27. 2.2 Members are asked to note that the progress of the 2026/27 annual audit plan and summaries of the findings from each audit assignment will be reported to the Board on a quarterly basis. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The subject matter of this report is the risk based Internal Audit Plan for 2026 –2027
Page 3
PUBLIC 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author : Karen Campbell, Chief Auditor
Page 4
Date March 2026 PUBLIC Annual Internal Audit Plan 2026/27 Finance & Resources Internal Audit
Page 5
Page 2 of 15 PUBLIC
Page 6
Page 3 of 15 PUBLIC Renfrewshire Council Annual Internal Audit Plan 2026/27 Contents Page Audit Plan Overview 4 - 9 Supporting Appendices 1 Annual Council Internal Audit Plan 2026/27 10 – 12 2 Annual Other Bodies Internal Audit Plan 2026/27 13 3 Analysis of plan by service 14 4 Annual Audit Plan 2026/27 – Integration Joint Board 15
Page 7
Page 4 of 15 PUBLIC Audit Plan Overview 1. Introduction 1.1 In line with the requirements of the Global Internal Audit Standards in the Public Sector and the Internal Audit Charter, a risk based internal audit plan for 2026/27 has been developed. In formulating the audit plan a risk assessment has been undertaken, giving consideration to the following sources of information: Risk assessment (1) Risk assessment and prioritisation of all auditable activities (audit universe). (2) Strategic and Corporate Risk Register. Consultation (3) The Chief Auditor has met with each member of the CMT and their senior management teams to ascertain any changes to operational practice and national policy and to determine their priorities and risks. (4) Senior Management from the Associate Bodies and One Ren have been consulted to ascertain their priorities and risks. (5) The Chief Executive has been consulted on what he sees as the council’s priority and risk areas for the forthcoming year. (6) Feedback from, and the expectations of, the Audit, Risk and Scrutiny Board are identified through the regular meetings with the members of the board. (7) The Chief Auditor has met with the local External Audit team to ascertain their approach to the statutory audit and identify any thematic reviews they will be undertaking to avoid any duplication of effort. Benchmarking (8) Other Local Authority internal audit plans. (9) Discussion with other Chief Auditors through the Scottish Local Authority Chief Auditors Group. Review of key internal reports (10) Renfrewshire’s Council Plan 2022 -2027 (11) The results of internal audit work in 2025/26 and in previous years. (12) Review of the results of the Business-as-Usual risk assurance modules. Review of key external reports (13) External Audit’s - Report to Members and the Controller of Audit on the 2024/25 Audit. (14) Audit Scotland: Best Value reports issued during 2025/26 (15) Review of other relevant Reports issued by External Inspection Agencies during 2025/26. 1.2 On the basis of the above, the audit engagements planned for 2026/27 are set out in Appendix 1, 2 and 4, for the Council, Associate Bodies and the Integration Joint Board in the following categories of audit activity: • Assurance • Governance • Contingency • Planning and Reporting 1.3 It is the responsibility of management to ensure that they have good governance, risk management and internal control arrangements over the functions they are responsible for. It is internal audit’s role to provide an independent, objective assurance and consulting activity. The scope of the internal audit plan encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes; as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives.
Page 8
Page 5 of 15 PUBLIC 1.4 Internal Audit has authorised full, free unrestricted access to any and all of Renfrewshire Council’s records, physical properties, systems and personnel pertinent to carrying out any audit engagement. 1.5 Delivery of the internal audit plan supports the requirement for the Chief Auditor to provide an annual opinion which is used to inform the annual governance statement. 1.6 The Chief Auditor shares information and coordinates activities with other internal and external providers of assurance and consulting services, as appropriate, to ensure proper coverage and minimise duplication of effort. Internal audit may place reliance on the work of other providers of assurance and the ability to do so will be considered during each audit engagement. 1.7 The plan also includes provision for managing and developing the internal audit activity including audit planning, reporting, periodic quality assessments and for following up on previous recommendations and reactive investigative work. The plan includes contingency time to allow for completion of work carried forward from 2025/26 and provides for consultancy engagements to be undertaken where these can improve the council’s operations, add value and improve the management of risks. Contingency time also provides for sufficient flexibility to accommodate changing risks and priorities during the course of the year. More detail on each of these elements is set out in sections 4 to 7 of this plan. 1.8 The internal audit service is delivered and developed in accordance with its purpose which, as set out in the Internal Audit Charter, is to provide assurance by independently reviewing the council’s risk management, control and governance processes. 2. The current business environment and key risk areas 2.1 The audit plan detailed in Appendix 1 has been developed to support the achievement of the council’s objectives and the challenges we face in achieving those objectives. The key challenges included in the planned audit work are detailed below:- (1) Asset Management Effective governance and management of the council’s property assets is essential, otherwise there is a significant risk of harm to employees and citizens, financial loss and service disruption within the Council. The 2026/27 audit plan includes time for:- • Reviewing the adequacy of the processes in place for operating the new Renfrew Bridge. • Conducting a compliance check on the evidence being submitted to the Housing Regulator to support the Housing Assurance Statement. (2) Financial Challenges The medium-term financial outlook for the Council remains challenging and significant savings will require to be made after many years of already delivering substantial efficiencies and reduction in our spending. Alongside this, our communities are experiencing increased cost- of-living costs and the demand for our services continues to be high. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2026/27 audit plan includes time for reviews of: • The processes in place to undertake financial assessments for HCSP Clients who access chargeable services to ensure the correct charges are applied. • The collection of Parking Income to ensure the procedures in operation are adequate. • Insurance Claims against the Council to ensure services are proactive in taking sufficient action to prevent the recurrence of future similar claims.
Page 9
Page 6 of 15 PUBLIC (3) Governance Arrangements The Council’s governance framework ensures that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded. It comprises the systems and processes, and culture and values, by which the Council is directed and controlled. These arrangements should be subject to regular review whilst undertaking transformation change programmes. During 2026/27 Internal Audit will undertake the following engagements:- • A compliance review of the Local Code of Corporate Governance to ensure there is adequate supporting evidence to support the code’s elements. • An operational review of the governance arrangements of the Council’s Joint Venture Partnership to ensure they are efficient and effective. • A compliance review of the processes in place to administer non-domestic rates on behalf of East Renfrewshire Council (4) Fraud and Error Attempts at undertaking cyber-attacks and other fraudulent activity against individuals and organisations are rapidly increasing. The Council is committed to minimising the risk of this activity occurring within the operation of its services by internal and external parties. To assist in achieving this aim, it is important that the Council continually reviews the adequacy of the internal controls in operation and its arrangements for continued service delivery if such activity occurred. The 2026/27 Audit Plan includes time for : • Reviewing the adequacy of the Business Continuity arrangements across the Council. • Undertaking a review to ensure the Council’s policies in place for staff induction and termination are complied with. (5) Workforce Planning There are recruitment and retention challenges for particular roles in the labour market and it may be very difficult to recruit suitably qualified and skilled officers into some job roles. In addition, there can be fluctuations in demand for certain Council Services or reduced staff availability throughout the year. The 2026/27 audit plan includes time for: • Reviewing the processes in place for the utilisation of casual/sessional staff. • Ensuring that the Absence Management Policy is being applied as intended within the HCSP. (6) Public Protection Public protection is a wide-ranging agenda relating to the protection of vulnerable people, communities, businesses and organisations. During 2026/27, internal audit will review the adequacy of the arrangements in place for : • The resettlement of refugees. • Ensuring that the appropriate pre-employment checks for staff working in regulated roles in sheltered housing complexes are undertaken. • Administering medicine to school pupils. (7) Strategic Sustainable Planning for People and Assets When major transformation is ongoing to deliver the best services possible, it is inevitable that job roles and service processes will change throughout the Council. This plan includes time for operational reviews of:
Page 10
Page 7 of 15 PUBLIC • Technical Services processes to ensure there are adequate internal controls in place and they meet client requirements. 2.2 There are a number of significant risks, arising from the external and internal environment, which could impact on the council’s ability to achieve its objectives. The most significant risks and the risk control measures to manage these risks, are identified through the council’s corporate risk management process. Subject to the overall flexibility of the Audit Plan, priority will be given to audit engagements which impact on the council’s strategic and corporate risks. 3. Allocation of Resources 3.1 In addition to the internal audit assurance function, the Chief Auditor has managerial responsibility for counter fraud which is excluded from the calculation of available operational audit resources. 3.2 The Internal Audit Service is a small team with a permanent current establishment of 6 Full Time Equivalents but currently has one vacancy. The current Chief Auditor was appointed permanently to the role during 2025/26 and one of the Senior Auditors has been covering the Assistant Chief Auditor’s post on an interim basis, leaving one Senior’s Auditor’s post vacant. The continual transformation of service delivery across organisations has resulted in a change of desired competencies for Auditors. In addition some councils have faced resilience risks owing to their small size, composition and difficulty recruiting experienced staff. A decision was therefore taken to conduct a review of the current internal audit structure with regards to workforce planning and improving resilience within internal audit and counter fraud services. This review has been completed and a revised structure has been agreed with the Director of Finance and Resources. Discussions are now ongoing to progress the implementation of the revised structure. The Staffing Full Time Equivalents will remain the same. 3.3 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. The calculation of operational staff time has been based on the permanent establishment of 6 full time equivalent employees , with 3 qualified members and with a vacancy factor built into the calculation. 3.4 Resources from any unfilled elements of posts and other available audit resource will be used flexibly to ensure that the audit plan commitments are met, through the engagement of temporary staff and other audit service providers where appropriate. Currently 60 days are planned to be provided from other service providers. The Chief Auditor is responsible for managing the Internal Audit budget. The team is considered to be adequately resources. 3.5 Non-operational time includes provision for training, performance management and service development. The training budget has been increased to enable internal audit staff to study for a relevant professional qualification. Where engagements are undertaken by the other audit service providers, these can provide an opportunity for benchmarking, training and development. Sufficient resources are available to engage specialist contractors where necessary to address any specific risks faced by the council. 3.6 The total available resource is 1144 days; the operational audit time available for 2026/27 has been identified as 841 days (74%). The remaining 303 days (26%) relates to training, service development, administration and management. Resources are assessed as being sufficient to provide an evidenced based opinion. 3.7 The following paragraphs provide an overview of how the audit time has been allocated to audit categories for the Council and the Associated Bodies we provide services to. A summary of the operational time by audit category is detailed in table 1 below. The analysis of non- operational audit activity is detailed in the table 2 below. The planned operational/non- operational time for 2025/26 is given for comparative purposes.
Page 11
Page 8 of 15 PUBLIC 2025/26 2026/27 Category of audit Planned Days % of Operational Time Planned Days % of Operational Time GOVERNANCE 76 9% 111 13% ASSURANCE 360 41% 281 34% CONTINGENCY note 1 295 34% 302 36% AUDIT PLANNING / REPORTING 138 16% 147 17% TOTAL OPERATIONAL TIME 869 100% 841 100% Table 1 Notes 1. This category includes time for the finalisation of the previous year’s audits, corporate exercises and groups, investigations, significant project consultancy activities and emerging priorities. 2025/26 2026/27 Activity Planned Days % of Non - operational Time Planned Days % of Non - operational Time TRAINING 51 22% 142 47% STRATEGIC MANAGEMENT 16 7% 17 6% TEAM ADMINISTRATION 91 39% 76 25% DEVELOPMENT note 1 73 32% 68 22% TOTAL NON-OPERATIONAL TIME 231 100% 303 100% Table 2 Notes 1. This category includes time allocated to development activities to support continuous improvement. 4. Governance (13% of operational time) 4.1 Internal Audit must evaluate the risk exposures relating to the council and associate bodies governance arrangements. The engagements within this category form the basis for the Chief Auditor’s annual audit opinions and support the annual governance statements. 4.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part A in respect of the current year, with a total of 111 days being allocated to these engagements for 2026/27. 5. Assurance (33% of operational time) 5.1 A risk-based assessment has been undertaken of all auditable areas taking into account the risk management framework and the expectation of senior management and the Audit, Risk and Scrutiny Board. The engagements within this category also form the basis for the Chief Auditor’s annual opinions and support the annual governance statements. For each engagement internal audit will consider whether there are any available external sources of assurance that can be relied upon to deliver the plan.
Page 12
Page 9 of 15 PUBLIC 5.2 Time is also allocated to following up on the implementation of prior years’ audit recommendations. 5.3 The results of the risk assessment are detailed at Appendix 1 and 2, Part B in respect of the current year, with a total of 281 days being allocated to these engagements for 2026/27. 6. Contingency (36% of operational time) 6.1 This category includes time allocations for finalisation of the 2025/26 audit plan, undertaking reactive investigations of theft, fraud or other malpractice and provides for post-report work which includes attending disciplinary or appeal hearings, employment tribunals and court, as required. It also includes time for involvement in Council projects, relevant Council Governance Groups and provision of advice in relation to changes in working practices as requested. 6.2 The allocation of time for this category is an estimate based on prior experience and available resources. However, this will be monitored during the course of the year to ensure that internal audit continue to be in a position to respond to other priority areas which emerge during the course of the year, and, if necessary, revise the audit plan accordingly. Appendix 1 and 2, Part C details the indicative time of 302 days allocated across the contingency heading. 6.3 Should more time become available this will be added to the contingency budget and will be used to deliver audit reviews from the reserve list detailed on Appendix 1, Part E. 7. Audit Planning / Reporting (17% of operational time) 7.1 This category includes annual planning activity and reporting arrangements to the Corporate Management Team and the Audit, Risk and Scrutiny Board, the Integration Joint Board Audit, Risk and Scrutiny Board and the Boards of the other bodies we provide internal audit services to under a service level agreement. Appendix 1 and 2, Part D details the time of 147 days allocated to planning and reporting activities. 8. Analysis of Plan by Service 8.1 Appendix 3 shows the amount of operational audit time allocated to individual services in 2026/27 and compares it to the planned days for 2025/26. 8.2 The planned days allocated to all services relates to work which is cross-cutting rather than service specific as well as time which is allocated out to services as the year progresses, such as contingency and investigations. 9. Conclusion 9.1 The annual internal audit plan for 2026/27, based on the strategic risk assessment, reflects the current priorities and challenges for the council, and demonstrates that the internal audit service continues to deliver added value while continuing to improve the service in line with best practice. 9.2 The allocation of internal audit resources is sufficient to allow for flexibility to deal with emerging priorities and provide adequate coverage of governance, risk management and internal control to inform the annual assurance statement. 9.3 In order to continue to focus on areas of greatest priority or emerging risks and other unforeseen circumstances, the plan will be subject to regular review during the course of the year. The Audit, Risk and Scrutiny Board will be requested to approve any necessary changes. Chief Auditor March 2026
Page 13
Page 10 of 15 PUBLIC Appendix 1 Renfrewshire Council Internal Audit Annual Plan 2026/27 Entity Engagement Title Service Days Allocated Risk Category Council Plan Theme Objective Rationale Part A – Governance 66 Corporate Governance Corporate Governance Framework Corporate - All Services 6 N/A Living Our Values Compliance Regulatory Requirement Regeneration and Investment Governance of Joint Venture Partnership Chief Executive’s 20 Strategic Economy Operational Significance of Risk Insurance Services Insurance Services Finance & Resources 20 Strategic Living our Values Operational Organisational Theme or Trend Corporate Asset Management Bridge Operation Policies Environment, Housing & Infrastructure 20 Strategic Economy Operational Organisational Theme or Trend Part B – Assurance 238 Follow Up Follow Up Corporate - All Services 35 N/A N/A Operational Regulatory Requirement Policies and Procedures Commencement & Termination of Staff Corporate – All Services 20 Strategic/ BAU Living Our Values Cyber Significance of Risk Workforce Planning Sessional/Casual Workers Corporate – All Services 25 Strategic Fair Operational Organisational Theme or Trend Business Continuity – All Services Business Continuity Corporate – All Services 20 Strategic/ BAU Living Our Values Cyber Significance of Risk Schools Procedures Administration of Medicines Children’s Services 20 N/A Fair Compliance Significance of Risk Parking Charges & Penalties Parking Income Environment, Housing & Infrastructure 20 Strategic Financial Sustainability Financial Significance of Risk Technical Services Technical Services Operations Environment, Housing & Infrastructure 20 N/A Place Operational Time since last Engagement
Page 14
Page 11 of 15 PUBLIC Entity Engagement Title Service Days Allocated Risk Category Council Plan Theme Objective Rationale Housing Assurance Statement Housing Assurance Statement Environment, Housing & Infrastructure 8 Place Compliance Regulatory Requirement Homeless and Housing Support Services Resettlement/Sheltered Housing Environment, Housing & Infrastructure 20 Strategic Fair Compliance Significance of Risk Client Financial Assessment & Charges Financial Assessments Finance & Resources /HSCP 20 Strategic Living Our Values Financial Regulatory Requirement Non-Domestic Rates Non-Domestic Rates Finance & Resources 10 N/A N/A Financial Regulatory Requirement Supporting Attendance Supporting Attendance HCSP 20 BAU Living Our Values Compliance Organisational Theme or Trend Part C – Contingency 295 Contingency Contingency Corporate - All Services 120 Contingency Corporate Groups Corporate - All Services 35 Contingency Investigations Corporate - All Services 140 Part D – Planning & Reporting 124 Planning & Reporting Planning & Reporting Corporate - All Services 124 Part E – Prioritised Reserve List 125 Pupil Registration System SEEMIS Children’s Services 25 Service
Page 15
Page 12 of 15 PUBLIC Entity Engagement Title Service Days Allocated Risk Category Council Plan Theme Objective Rationale Child payments Section 22 Payments - Child Children’s Services 20 Strategic Fair Compliance Regulatory Requirement Licensing Licensing - Short Term Lets Finance & Resources 20 N/A Place Compliance Regulatory Requirement VAT Management VAT Management Finance & Resources 20 Strategic Living Our Values Compliance Regulatory Requirement Corporate Policy and Planning Trading Operations - New Regulations Finance & Resources 20 Strategic Living Our Values Financial Regulatory Requirement Marketing and Events Marketing & Events Chief Executive’s 20 N/A Place Operational Organisational Theme or Trend
Page 16
Page 13 of 15 PUBLIC Appendix 2 Other Bodies Internal Audit Annual Plan 2026/27 Entity Engagement Title Service Objective Rationale Days Allocated Part A – Governance 45 Integration Joint Board – Governance Arrangements Clinical Governance Processes Integration Joint Board Compliance Regulatory Requirement 20 Integration Joint Board – Governance Arrangements Corporate Governance Framework Integration Joint Board Compliance Regulatory Requirement 5 SE – Governance Arrangements Governance of Services Provided to External Organisations Scotland Excel Compliance Significance of Risk 20 Part B – Assurance 43 OneRen – Other Systems Establishments’ Stock Control/Inventory Processes OneRen Operational Time since last audit 23 RVJB – Other Systems Payroll Processes RVJB Operational Organisational Theme or Trend 20 Part C – Contingency 7 Contingency Contingency All Associate Bodies 7 Part D – Planning & Reporting 23 Planning & Reporting Planning & Reporting All Associate Bodies 23
Page 17
Page 14 of 15 PUBLIC 2025/26 2026/27 Service Planned Days % of Operation al Time Planned Days % of Operational Time All Services note 1 535 62% 525 63% Chief Executive’s Service 20 2% 20 2% Finance & Resources 90 10% 50 6% Children’s Services 20 2% 20 2% Adult Services 20 2% 20 2% Environment, Housing & Infrastructure 68 8% 88 11% COUNCIL TOTAL 753 87% 723 86% Scotland Excel 25 3% 25 3% Renfrewshire Valuation Joint Board 25 3% 25 3% Renfrewshire Health & Social Care Integration Joint Board (Appendix 4) 40 4% 42 5% OneRen 26 3% 26 3% TOTAL 869 100% 841 100% Notes 1 Planned time includes, Follow up Audit, Contingency, Planning and Reporting and an element of Cross cutting Assurance and Governance Audits and is allocated against services during the course of the year Appendix 3 Analysis by Service
Page 18
Page 15 of 15 PUBLIC Audit Category Engagement Title No. of days Detailed work Governance Local Code of Corporate Governance 5 Annual review of the adequacy and compliance with the Local Code of Corporate Governance to inform the governance statement. Governance Clinical Governance 20 The purpose of the audit is to provide assurance that the accountability arrangements in place for continuously improving service quality and safeguarding high standards of care are applied consistently. Planning & Reporting Annual Plan, Annual Report and Audit Committee annual assessment, reporting & Training 14 The Chief Internal Auditor is required to prepare an annual plan and annual report for the Audit Committee, summarising the work undertaken by Internal Audit during the year and using this to form an opinion on the adequacy of the control environment of the IJB. Time is also available to assist in the annual assessment against the CIPFA position statement on Audit Committees. Contingency Ad-hoc advice and Consultancy 3 Time for advice and consultancy on relevant priorities and risks or change related projects and following up on the implementation of internal audit recommendations. Appendix 4 Annual Audit Plan 2026/27– Integration Joint Board