5. CIPFA IA Governance Code Report
Renfrewshire Council · 19 May 2025
Back to Audit, Risk and Scrutiny Board — 19 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 19 May 2025 ___________________________________________________________________ Report by: Director of Finance & Resources ___________________________________________________________________ Heading: CIPFA Code of Practice – Governance of Internal Audit in UK Local Government ________________________________________________________ 1. Summary 1.1 The Chartered Institute of Public Finance and Accountancy (CIPFA) has published a Code of Practice for the Governance of Internal Audit in UK Local Government to support authorities in establishing and maintaining their internal audit arrangements in line with the statutory regulations It came into effect from 1 April 2025 and supports the practice of internal audit under the Global Internal Audit Standards in the UK Public Sector. 1.2 The Code is aimed at those responsible for the governance of internal audit including the Council’s Section 95 Officer and the Audit Committee and is also relevant for heads of internal audit and audit providers to the sector. 1.3 This report seeks to provide members with an overview of the new CIPFA guidance and provide assurance to members as to how the Council, in the main complies with the guidance. The outcomes of self assessment exercise by the Interim Chief Auditor and improvement actions identified are detailed in Appendix 1 of this Report. __________________________________________________________________ Recommendations 2.1 It is recommended that members of the Audit, Risk and Scrutiny Board note the: • results of self assessment exercise undertaken to ensure compliance with the CIPFA Code on the Governance of Internal Audit
Page 2
• evidence available to support compliance • actions to be undertaken to ensure full compliance with the code ___________________________________________________________________ 3. Background 3.1 Local government bodies have a requirement for internal audit as set out in national regulations. New standards, Global Internal Audit Standards (UK public sector), have been introduced from 1 April 2025, which Local Authority Internal Audit teams must follow, consisting of the Global Internal Audit Standards (GIAS) of the Institute of Internal Auditors (IIA) and the CIPFA Application Note: Global Internal Audit Standards in the UK public sector. 3.2 When the IIA published the GIAS, it recognised that in the public sector, governance structures or other laws or regulations may impact on how the essential conditions can be applied. This is the case in UK local government, where there isn’t a straightforward replacement for the ‘board’ as described in GIAS. 3.3 This Code provides the framework to meet the objectives of the essential relevant conditions of the Global Internal Audit Standards (UK public sector), by providing for the necessary governance of internal audit, but in a way that is appropriate for UK local government bodies. It includes roles and responsibilities of the audit committee, senior management and those charged with governance towards internal audit. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development – None 3. Community Planning – Safer and Stronger - None 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None
Page 3
9. Procurement - None 10. Risk - The report addresses the risk of non-compliance against the revised CIPFA guidance for the Governance of Internal Audit 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights – None. ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor
Page 4
Appendix 1 Compliance with the CIPFA Code – Governance of Internal Audit Provision Compliance Evidence Action 1. Providing authority for internal audit 1.1 Internal Audit’s Mandate - To be effective and to meet the requirements of professional standards, internal audit’s authority needs to be established. Internal Audit’s (IA) Mandate is stated in national regulations. However each Local Authority may agree a wider statement of IA’s authority which should be formally approved. Yes – the IA Mandated Authority and Access are set out in the Internal Audit Charter which has been approved by the Audit, Risk and Scrutiny Board and in the Council’s Financial Regulations and Codes Internal Audit Charter A self assessment is being undertaken by the Interim Chief Auditor against the GIAS in the UK Public Sector. An action plan will be prepared detailing any improvement actions required, including updating the IA Charter. Completion Date – 18 August 2025 1.2 Internal Audit Charter - The chief audit executive has a responsibility to prepare a charter that conforms with GIAS in the UK public sector. The Charter confirms the means by which leaders, managers and decision makers can have confidence that the governance arrangements that they have approved are being implemented, operating as intended, and remain fit for purpose Yes – IA Charter stipulates arrangements for periodic assessments of IA Internal Audit Charter N/A The Charter states management oversight arrangements in place for IA Yes – the Charter states the line management arrangements for IA. Internal Audit Charter N/A The Charter sets out the role of IA Yes – the scope of IA is listed Internal Audit Charter N/A
Page 5
Appendix 1 The Audit Committee must approved the Charter Yes – included in the Audit, Risk and Scrutiny Board’s Term of Reference ARSB Minutes N/A 1.3 Support for IA - Internal audit’s activities require access to and support from senior management, the audit committee and those charged with governance. Support allows internal audit to apply their mandate and charter in practice and meet expectations. Internal Audit is adequately supported by those charged with Governance Yes – in addition to regular management meetings with the Director of Finance and Resources, quarterly meetings also take place with the Council’s Chief Executive and Monitoring Officer to discuss IA’s work. Meetings also take place with all Service Senior Management Teams. The Chief Auditor can report directly if required to the Chief Executive, ARS Board members or the Council. IA has unrestricted access to all records and properties within the Council Internal Audit Charter, Meeting Agendas N/A Direct reporting line of the chief audit executive is not lower than a member of the senior management team and has access to all members of the team. Yes - Chief Auditor reports to the Director of Finance & Resources and has access the Chief Executive and all members of the Corporate Management Team. The internal audit plan is approved by the Audit, Risk and Scrutiny Board. The Chief Auditor also reports directly to the ARSB. Internal Audit Charter N/A Chief Auditor is a senior Officer Yes – Chief Auditor reports directly to the Director of Finance and Resources and is a member of the Finance and Resources Senior Management Team Internal Audit Charter N/A Audit Committee meets at least annually with the Chief Auditor without senior management present. Yes - this is included in the Guidelines for Operation of the Audit, Risk & Scrutiny Board. This meeting will take place when the Internal Audit Annual Report is submitted to ARSB. Guidelines for Operation of the Audit, Risk & Scrutiny Board. N/A 2 Positioning internal audit independently
Page 6
Appendix 1 2.1 Organisational independence- On behalf of those charged with governance, senior management needs to establish and safeguard internal audit’s independence Internal audit’s access to staff and records, as set out in regulations and the charter, operates freely and without any interference to its scope, performance of engagements or communication of results. Yes – Internal Audit is responsible for determining the scope of an audit and have access to Council staff and records Internal Audit Charter N/A Chief Audit Executive reports in own right on work of Internal Audit Yes – The Chief Auditor submits all Internal Audit Reports directly to the ARSB ARSB Papers N/A Where there are actual or potential impairments to the independence of internal audit, senior management should work with the chief audit executive to remove or minimise them or ensure safeguards are operating effectively. Yes – Conflict of Interest procedure in place within Internal Audit. N/A Recognise that if the chief audit executive has additional roles and responsibilities beyond internal auditing, appropriate safeguards must be put in place by senior management to protect the independence of internal audit and support conformance with professional standards. Yes – Chief Auditor is responsible for Risk Management and Counter Fraud Teams. However when internal audit reviews are being undertaken on these areas, they are carried out by an external contractor. Risk Management and Insurance Team is transferring to FAR Business Services during 2025/26 2024/25 External Review of Risk Management and FAR Board Papers – FAR Staffing Update – April 2025 N/A Matters around the appointment, removal, remuneration and performance evaluation of an in-house chief audit executive will be undertaken by senior management Yes – Director of Finance and Resources has responsibility to undertake these tasks in accordance with Council Policies Council Policies N/A The audit committee should provide feedback on the proposed job description and the performance evaluation of the chief audit executive should include feedback from the Yes - the Job Description for Chief Auditor’s post is currently being refreshed in light of the forthcoming management structure changes. The Chair of the ARSB and the Chief Executive are Performance Evaluation Form Chief Auditor’s Job Description to be Updated Completion Date - 30 June 2025
Page 7
Appendix 1 chair of the audit committee. asked to provide feedback when the Chief Auditor’s performance is being evaluated 2.2 Qualifications of the chief audit executive - Ensuring effective leadership of the internal audit team requires a suitably qualified and experienced chief audit executive The Application Note: GIAS in the UK public sector sets out the qualifications and competencies expected of the chief audit executive. These must be taken into account by senior management when recruiting to the post. Yes - the Chief Auditor job description states that they must hold a relevant professional recognised qualification and have the necessary experience Chief Auditor’s Job Description N/A 3. Oversight of internal audit 3.1 Audit committee interaction - To ensure the effectiveness of internal audit, it should be overseen by the audit committee All audit committees should follow the CIPFA audit committee guidance for the oversight of internal audit. Yes - the ARSB has undertaken a self assessment against the CIPFA Audit Committee Guidance and all the actions have been implemented. Annual Self Assessments are now planned Council Report N/A Audit committees must agree its work plan with the chief audit executive to ensure there is appropriate coverage of internal audit matters within audit committee agendas. Yes - the Director of Finance and Resources, Monitoring Officer and Chief Auditor facilitated the ARSB, self assessment exercise and the Terms of Reference of the ARSB were updated as part of this exercise ARSB Terms of Reference N/A Audit committee must familiarise itself with the authority’s assurance framework and approach to governance, risk management and internal control arrangements to fulfil the wider terms of reference of the committee. This understanding will facilitate its interactions with internal audit. Yes - a report detailing how the Council complies with the Local Code of Corporate Governance and listing the evidence to support this code is submitted annually to the ARSB. A programme of training, including Governance is in place for ARSB Members. ARSB Reports and Training Programme N/A Senior management should update the audit committee on significant changes to governance, risk and control arrangements and any concerns they may have on assurance. The Yes - there is an annual report on the compliance with the Local Code of Corporate Governance . The unaudited annual governance statement is submitted to the ARSB. ARSB Reports N/A
Page 8
Appendix 1 audit committee should have oversight of the annual governance statement before final approval. The committee should also oversee the tracking and implementation of the actions agreed following audits. Yes - the Chief Auditor’s Annual Reports includes the implementation rates for recommendations followed up. All critical recommendations not implemented by their due date are reported to the ARSB separately IA Annual Report/Critical Recommendations Followed Up Report N/A Where internal audit consider the management of risk or proposed actions in response to audit engagements represent an unacceptable level of risk to the authority, the audit committee must review the matter Yes - this would be highlighted on the Committee Summary submitted to Board for the engagement undertaken. Internal Audit Committee Summaries N/A 3.2 Resources The audit committee and senior management must engage with the chief audit executive to review whether internal audit’s financial, human and technological resources are sufficient to meet internal audit’s mandate as set out in the regulations and achieve conformance with GIAS in the UK public sector. Yes - the level of resource required is detailed in the Internal Audit Plan and the Annual Report compares the actual resources to the planned resource and any issues highlighted. If resource issues resulted in a limitation of scope, this would be highlighted in the governance statement. ARSB Reports – Internal Audit Annual Plans and Annual Reports N/A The long-term viability of the internal audit function must be considered by Senior Management. Yes -This is considered by Senior Management and can be demonstrated by the recent project to examine a shared service proposal for Internal Audit ARSB Reports – Internal Audit Progress Reports N/A 3.3 Quality – Conformance against GIAS in the UK Public Sector The audit committee must review the results of the chief audit executive’s assessment of conformance against GIAS in the UK public sector, including any action plan. Partly - A self assessment exercise is currently being undertaken on conformance with these standards and will be reported upon to the ARSB on completion. ARSB Report Finalise the Self Assessment Exercise of compliance with GIAS in the UK public Sector and prepare action plan
Page 9
Appendix 1 Completion Date - 31 July 2025 The audit committee must review the chief audit executive’s annual report, including the annual conclusion on governance, risk management and control, and internal audit’s performance against its objectives. The committee should review in-year updates and make appropriate enquiries if there are concerns about internal audit performance. Chief Auditors annual report including an assurance statement is submitted to the ARSB. ARSB also receives quarterly reports of Internal Audits progress and performance ARSB Reports N/A To meet the requirements of the regulations (the mandate) for internal audit, the audit committee must satisfy itself on the effectiveness of internal audit. They should take into account conformance with the standards, interactions with the committee, performance and feedback from senior management. Their conclusions should be reported to those charged with governance, for example as part of the audit committee’s annual report. Partly - The Chair of the ARSB and potentially other members will be contacted by the External Assessor of Internal Audit to provide feedback on Internal Audit as part of the external review which is undertaken every 5 years. As well as receiving quarterly internal audit performance reports, the ARSB also receive reports on the outcomes of Internal Audit’s Self and External Assessments on whether they undertake their duties in compliance with the current internal audit standards. However the Board’s opinion on the effectiveness Internal Audit is not formally documented as part of the ARSB annual report ARSB reports The ARSB Annual Report should report on the effectiveness of Internal Audit as part of their Annual Report Completion Date - May 2026 3.4 External quality assessment Senior management must ensure that internal audit has an external quality assessment at least once every five years of its conformance against GIAS in the UK public sector, including this Code. Yes – the Scottish Local Authority Internal Audit Group have a process in place where the Chief Auditor of an Local Authority will undertake the external assessment. Renfrewshire Council’s external assessment was last undertaken by South Ayrshire Council in 2023. ARSB Report N/A
Page 10
Appendix 1 The audit committee must receive the complete results of the assessment and consider the chief audit executive’s action plan to address any recommendations. Progress should be monitored Yes – the external assessment report and action plan were reported to the ARSB ARSB Report N/A