4. Global Internal Audit Standards in the Public Sector
Renfrewshire Council · 18 August 2025
Back to Audit, Risk and Scrutiny Board — 18 August 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Global Internal Audit Standards in the UK Public Sector ________________________________________________________ 1. Summary 1.1 The Institute of Internal Auditors (IIA) introduced new Global Internal Audit Standards (GIAS) which came into force in January 2025. The Chartered Institute of Public Finance and Accountancy (CIPFA) who are the local government internal audit standard setters, recognised that there may be difficulties for Local Authorities to fully comply with these standards and have published an Application Note, effective from the 1 April 2025. 1.2 Auditors working in the UK public sector must follow the requirements of the Global Internal Audit Standards and the additional requirements set out in the Application Note and refer to this professional framework as Global Internal Audit Standards in the UK Public Sector. (GIAS in the UKPS) 1.3 Whilst this framework came in force on the 1 April 2025, it is not expected that Internal Audit Teams will be able to demonstrate full compliance with these standards on that date. They must work in accordance with the new standards from 1 April in order to build up their conformance. 1.4 This report seeks to provide members with an overview of the gap analysis undertaken to determine what actions are required to ensure compliance with the new standards. The outcomes of self-assessment gap analysis exercise by the Interim Chief Auditor and improvement actions identified are detailed in Appendix 1 of this Report. 1.5 As can be seen from Appendix 1, in the main Internal Audit currently comply with the spirit of the standards but require to undertake some actions throughout
Page 2
the year to achieve full compliance or enhance the processes already in place. In order to keep members informed of progress, an updated action plan will be submitted to this Board in March 2025 – 6?. __________________________________________________________________ 2. Recommendations 2.1 It is recommended that members of the Audit, Risk and Scrutiny Board note the: • results of the self-assessment exercise undertaken to ensure compliance with the Global Internal Audit Standards in the UK Public Sector • actions to be undertaken to ensure full compliance with the framework. ___________________________________________________________________ 3. Background 3.1 Local government bodies have a requirement for internal audit as set out in national regulations. New standards, Global Internal Audit Standards in the UK public sector, have been introduced from 1 April 2025, which Local Authority Internal Audit teams must follow, consisting of the Global Internal Audit Standards (GIAS) of the Institute of Internal Auditors (IIA) and the CIPFA Application Note: Global Internal Audit Standards in the UK public sector. 3.2 In addition, the Code of Practice on the Governance of Internal Audit in the UK Public Sector, should also be used to interpret some of the essential conditions in the new standards. Compliance with this Code was previously reported upon to members of the ARSB in May 2025. 3.3 The Standards consist of five domains: • Domain I: Purpose of Internal Auditing. • Domain II: Ethics and Professionalism. • Domain III: Governing the Internal Audit Function. • Domain IV: Managing the Internal Audit Function. • Domain V: Performing Internal Audit Services. 3.4 In addition, the GIAS also recognise that internal auditors in the public sector work in a political environment under governance, organisational, and funding structures that may differ from those of the private sector. To assist in conformance with these standards, they contain a section “Applying the Global Internal Audit Standards in the Public Sector” which describes strategies for conformance amid the circumstances and conditions unique to internal auditing in the public sector. 3.5 All Internal Audit Staff have read the GIAS in the UKPS and training is going to be provided on certain elements . With regards to Domain 5 – Performing the Internal Audit Services, it is worthwhile noting that all internal audit staff have
Page 3
undertaken a self-assessment gap analysis to assist in identifying the most significant training areas. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development – None 3. Community Planning – Safer and Stronger - None 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The report addresses the risk of non-compliance against the revised professional framework for internal audit. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights – None. ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor
Page 4
Appendix 1 Compliance with the Global internal Audit Standards in the UK Public Sector Domain/Standard Compliance Assessment (1) Planned Actions Planned Completion Date I Purpose of internal auditing Internal auditing strengthens the organisation’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight to help the board and senior management to protect the assets, reputation and sustainability of the organisation. . Generally conforms – In practice these are the aims of the work undertaken by Internal Audit The Internal Audit Charter and Mandate will be updated to include this definition and will be brought to the ARSB for approval. November 2025 II Ethics and Professionalism Principle 1 – Demonstrate Integrity Standard 1.1 – Honesty and Professional Courage Internal auditors must perform their work with honesty and professional courage. They must be truthful, accurate clear, open and respectful in all professional relationships and communications and disclose all material facts. They must exhibit professional courage by communicating truthfully and taking appropriate action when facing difficult situations and communicating favourable and unfavourable results. Generally conforms – This has always been an essential requirement when carrying out Internal Audit Work. Internal Audit Staff are bound by the Council’s Employee’s Code of Conduct which includes the Nolan 7 Principles of Public Life, one of which is Integrity. Refresher training is being provided to Staff from August onwards and the Internal Audit Competency Framework will be amended to explicitly include this principle. Formal Training Records will be introduced. December 2025 Standard 1.2 – Organisation’s Ethical Expectations Internal auditors must understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and must be able to recognise conduct that is contrary to those expectations. Any concerns must be reported in accordance with Council’s policies and procedures. Generally conforms – This need for ethical behaviour is especially relevant in the UK public sector where those delivering public services are both servants of the public and stewards of public As Above December 2025
Page 5
Appendix 1 resources. Internal Audit Staff must adhere to the Nolan Principles of Public Life Standard 1.3 – Legal and Ethical Behaviour Internal auditors must not engage in or be a party to any activity that is illegal or discreditable to the organisation or the profession of internal auditing or that may harm the organisation or its employees. If they identify any violations, they must report such incidents to those who have authority to take the appropriate action. Generally conforms – this is an essential characteristic of an Internal Auditor and they conduct investigations into suspected irregularities involving employees within the course of their duties. N/A Principle 2 – Maintain Objectivity Standard 2.1 – Individual Objectivity Internal auditors must maintain professional objectivity when performing all aspects of internal audit services by applying an impartial and unbiased mindset and make judgments based on balanced assessments of all relevant circumstances. They must manage potential biases. Generally conforms – this is another essential characteristic and one of the Nolan principles outlined in the Employee’s Code of Conduct. N/A Standard 2.2 – Safeguarding Objectivity Internal Auditors must recognise and avoid or mitigate actual, potential, and perceived impairments to objectivity. They must not accept any gifts or favours for undertaking their role, avoid all conflicts of interests and not be unduly influenced by their own interests or interests of others including senior management or the political environment. In addition methodologies to address impairments to objectivity must be established. Generally conforms – The Employee’s Code of Conduct which employees have signed for contains a section on Conflicts of Interest and the Council has a Gifts and Hospitality Policy in place. . Staff to be provided with refresher training in this area and a Conflict of Potential Interest form will be reintroduced to formalise this process. December 2025 Standard 2.2 – Disclosing Impairments to Objectivity If Internal Auditors become aware of an impairment that has or may affect their objectivity, they must disclose the impairment to the Chief Audit Executive or a designated supervisor as soon as it is known. Generally conforms – Internal Auditors are aware to disclose any potential conflicts to the Chief Auditor as soon as they are known. A Conflict of Potential Interest form will be reintroduced to formalise this process. December 2025
Page 6
Appendix 1 The Chief Audit Executive (CAE) determines that an impairment is affecting an Internal Auditor’s ability to perform duties objectively or is discovered after the engagement is completed, the Chief Audit Executive must discuss the impairment with the management of the activity under review, and/or senior management and determine the appropriate actions to resolve the situation. If the objectivity of the CAE is impaired in fact or appearance, the Chief Audit Executive must disclose the impairment to the Board/Manager. Generally conforms – The Chief Auditor completes a declaration of interest form annually and would flag any impairments to the Director of Finance and Resources/Head of Corporate Governance. N/A Principle 3 – Demonstrate Competency Standard 3.1 – Competency Internal Auditors must possess or obtain the required competencies to perform their responsibilities successfully including the knowledge, skills, and abilities suitable for one’s job position and responsibilities commensurate with their level of experience and possess knowledge of the GIAS in the UKPS. Generally conforms – the Internal Audit Service has a competency framework in place for Auditors to self-assess their competencies periodically and agree training plans with their Line Manager. The Internal Audit Team have familiarised themselves with the requirements of the GIAS in the UKPS. All mandatory training required by the Council is undertaken Formal training sessions have been arranged, commencing in August 2025 to ensure Internal Audit Staff have a full understanding of the requirements of the GIAS in the UKPS March 2026 Standard 3.1 – Continuing Professional Development Internal Auditors must maintain and continually develop their competencies to improve the effectiveness and quality of internal audit services, pursue continuing professional development including education and training and follow the Generally conforms – External and internal training opportunities are provided to staff in accordance with need. In addition, the Council is an Accredited Employer for the professional accountancy bodies and Formal Training Records will be established to record all training undertaken. March 2026
Page 7
Appendix 1 continuing professional development requirements of their professional body. run training sessions which is attended by Internal Audit staff. Principle 4 - Exercise Due Professional Care Standard 4.1 – Conformance with Global Internal Audit Standards The internal audit function’s methodologies must be established, documented, and maintained in alignment with the GIAS in the UKPS. Internal auditors must follow the Standards and the internal audit function’s methodologies when undertaking internal audit engagements. When internal auditors are unable to conform with a requirement, the chief audit executive must document and communicate a description of the circumstance, alternative actions taken, the impact of the actions, and the rationale. Generally conforms – This Gap Analysis exercise identified that our current methodologies comply in the main with these standards. Any amendments which have been identified will be introduced, including documenting any areas where it is not possible to adhere to the standards. Revised methodologies, where required, will be introduced into our working practices during 2025/26 and the Internal Audit Manual will be updated to reflect the changes. March 2026 Standard 4.2 – Due Professional Care Internal auditors must exercise due professional care by assessing the nature, circumstances, and requirements of the services to be provided, including the organisations objectives, clients and other stakeholders interests, adequacy of governance, risk management and control processes, scope, complexity, cost and timeliness of work. Generally conforms – This is taken into consideration when the objective and scope of the audit engagement are being prepared on the engagement plan which is agreed with client senior management prior to commencement of the audit. N/A Standard 4.2 – Professional Scepticism Internal auditors must exercise professional scepticism when planning and performing internal audit services by maintaining an attitude that includes inquisitiveness, critically assessing the reliability of information, be straightforward and honest when raising concerns and asking questions about inconsistent information and seek additional evidence to make a judgment about information and statements that might be incomplete, inconsistent, false, or misleading. Generally conforms – this is essential when carrying out internal audit engagements including employee investigations and our evidence and judgements are recorded in our evidence files and engagement report. Further training will be provided in this area to ensure all elements of this standard are undertaken. September 2025
Page 8
Appendix 1 Principle 5 – Maintain Confidentiality Standard 5.1 – Use of information Internal auditors must follow the relevant policies, procedures, laws, and regulations when using information. The information must not be used for personal gain or in a manner contrary or detrimental to the organization’s legitimate and ethical objectives. Generally conforms - All staff have completed the Councils Mandatory Training Courses on Information Governance and Cyber Security and are fully aware of Information Handling Policies. They are also aware of the restrictions in place for sharing internal audit information. N/A Standard 5.2 – Protection of information Internal auditors must be aware of their responsibilities for protecting information and demonstrate respect for the confidentiality, privacy, and ownership of information acquired when performing internal audit services or as the result of professional relationships. Generally conforms - All staff are fully aware of how to protect internal audit information. The Audit Manual has a section on confidentiality of information and there is a Report Protocol in place for issuing reports. A clear desk policy is in place. N/A III Governing the Internal Audit Section The CAE must discuss this domain with the board and senior management. The discussions are needed to inform the board and senior management about the importance of the essential conditions and to gain alignment among their respective responsibilities. Generally conforms – A report of the Code of Practice for the Governance of Internal Audit was submitted to the ARSB members in May 2025. This self-assessment will also further enhance members and senior management awareness of the requirements of this domain If agreed, a briefing could be provided to members to assure members that we are complying with this domain and the code of practice as far as possible. December 2025 Principle 6 – Authorised by the Board Standard 6.1 – Internal Audit Mandate The chief audit executive must provide the board and senior management with the information necessary to establish the internal audit mandate and this mandate detailing authority, legal requirements, role Generally conforms – the Internal Audit Charter is approved by the ARSB which contains a section on Authority. The Authority is also set The Internal Audit Charter will be updated to make it clearer that the Charter is also the Mandate and submitted to the ARSB for approval. November 2025
Page 9
Appendix 1 and responsibilities must be included in the charter approved by Board. out in the Council’s Financial Regulations and Codes Standard 6.2 – Internal Audit Charter The chief audit executive must develop and maintain an internal audit charter that specifies, at a minimum, the internal audit function’s: Purpose of Internal Auditing, Commitment to adhering to the GIAS, Mandate and Organisational position and reporting relationships. Generally conforms – the Internal Audit Charter contains most of these requirements The Internal Audit Charter will be updated to include the commitment to adhere to the GIAS in the UKPS. This will be submitted to the CMT and then to the ARSB for approval. November 2025 Standard 6.3 – Board and Senior Management Support The chief audit executive must provide the board and senior management with the information needed to support and promote recognition of the internal audit function throughout the organisation and coordinate the internal audit function’s board communications with senior management to support the board’s ability to fulfil its requirements. Generally conforms – the Chief Auditor reports to the Director of Finance and Resources, who agrees the budget for the Internal Audit Service and meets quarterly with the Chief Executive and Head of Corporate Governance. They are also a member of the Finance and Resource Senior Management Team. Internal Audit staff have unrestricted access to personnel, records and premises included the Chair of the ARSB. ARSB members have agreed the type of internal audit information submitted to Board. N/A Principle 7 Positioned Independently Standard 7.1 – Organisational Independence The chief audit executive must confirm to the board the organisational independence of the internal audit function at least annually and includes communicating incidents where independence may have been impaired. The Charter must state the reporting relationships and organisational position of Internal Audit. Any roles or responsibilities that have Generally conforms - The annual confirmation of independence is included in the Internal Audit Annual Report and the position of Internal Audit is stated in the Charter. The Chief Auditor reports directly to the ARSB. Any reviews of other teams N/A
Page 10
Appendix 1 the potential to impair the internal audit function’s independence, either in fact or appearance must be disclosed who are managed by the Chief Auditor are undertaken by an External Consultant. The Chief Auditor meets privately at least annually with the ARSB. Standard 7.2 – Chief Audit Executive Qualifications Chief audit executives in the public sector must hold appropriate professional CMIIA OR CCAB qualifications alongside relevant internal audit experience Generally conforms – these are a specification of the Chief Auditor’s post. N/A Principle 8 Overseen by the Board Standard 8.1 – Board Interaction The chief audit executive must provide the board with the information needed to conduct its oversight responsibilities. This information may be specifically requested by the board or may be, in the judgment of the chief audit executive, valuable for the board to exercise its oversight responsibilities. Generally conforms – The reports submitted to the ARSB are discussed annually at the Board. Both the Charter and Internal Audit Plan are approved by the ARSB. A summary of each Internal Audit Engagement and Internal Audit Performance Reports are submitted to the ARSB quarterly. N/A Standard 8.2 - Resources The chief audit executive must evaluate whether internal audit resources are sufficient to fulfil the internal audit mandate and achieve the internal audit plan. If not, the chief audit executive must develop a strategy to obtain sufficient resources and inform the board about the impact of insufficient resources and how any resource shortfalls will be addressed. Generally conforms - The Annual Internal Audit Plan states the resources available and whether they are sufficient to give adequate assurance. The Internal Audit annual report gives details of the actual resources utilised. If during the year, additional resource was required, this would be sent for approval to the Director of Finance & Resources and the ARSB would be informed of the outcome. N/A
Page 11
Appendix 1 Standard 8.3 - Quality The chief audit executive must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. Partially conforms – Since the last External Quality Assessment reported in September 2023, a formal internal assessment has not been undertaken due to the new standards coming into force and the recently completed review of how internal audit services are provided. Annual internal quality and assurance assessments will recommence during 2026/27 when all the amendments to working practices as a result of the GIAS in the UKPS are in place. March 2027 Standard 8.4 - External Quality Assessment The chief audit executive must develop a plan for an external quality assessment and discuss the plan with the board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation. Generally conforms – The Scottish Local Authority Chief Internal Auditors Group have a process in place for undertaking external assessments and this will continue to be followed and the results reported to the ARSB. N/A IV Managing the Internal Audit Function Principle 9 Plan Strategically Standard 9.1 - Understanding Governance, Risk Management and Control Processes To develop an effective internal audit strategy and plan, the chief audit executive must understand the organization’s governance, risk management, and control processes and the importance of value for money. Generally conforms – The Councils Code of Corporate Governance is reviewed by Internal Audit annually and the Chief Auditor is a member of the Corporate Risk Management Group. These processes are also reviewed during the annual audit planning process. The Annual planning protocol in the Audit Manual will be updated to incorporate all documents reviewed. All audit staff have undertaken risk management training and refresher training will be given on the Council’s governance arrangements March 2026 Standard 9.2 - Internal Audit Strategy
Page 12
Appendix 1 The chief audit executive must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation and aligns with the expectations of the board, senior management, and other key stakeholders. This strategy must include a vision stating the desired future of the internal audit service in the next 3-5 years and aide continuous improvement, Partially conforms – many requirements of the strategy are included in the Charter and Audit Manual and these require to be formalised into an Internal Audit Strategy Document. A formal strategy will be prepared including evidence of information and analysis that informs the strategy and submitted to Senior Management and the ARSB. Arrangements will be put in place to review the strategy as part of our internal quality assessment. November 2025 Standard 9.3 - Methodologies The chief audit executive must establish methodologies to guide the internal audit function in a systematic and disciplined manner to implement the internal audit strategy, develop the internal audit plan, and conform with the Standards. The methodologies must be evaluated, updated and training provided to staff. Generally conforms – Our methodologies for undertaking engagements are built into our audit management system files and the information obtained during the engagement is reviewed independently to ensure the methodology are followed. These methodologies are discussed at team meetings, amended when necessary and training provided as required. N/A Standard 9.4 – Internal Audit Plan The chief audit executive must create an internal audit plan that supports the achievement of the organisation’s objectives and based on the organisation’s strategy and evaluation of governance, risks and control processes with input from senior management and the Board. The plan must identify the resources required to undertake the plan and revised as necessary. The plan should be approved Generally conforms – an audit universe which has been risk assessed and is reviewed annually as part of the planning process is incorporated into our audit management system. Part of our Planning Protocol is to meet with all Senior Management teams to enable them to input into the plan. Planning Protocol to be updated within the Audit Manual. March 2026
Page 13
Appendix 1 by the Board and the Board should be notified of any changes. The plan is approved by the ARSB and they also approve any changes. Standard 9.5 – Coordination and Reliance The chief audit executive must coordinate with internal and external providers of assurance services and consider relying upon their work. Coordination of services minimises duplication of efforts, highlights gaps in coverage of key risks, and enhances the overall value added by providers. Partially conforms – We share information and meet regularly with GGCHB and City Deal Internal Auditors. We also share information with External Audit. Planning Meetings with Council Senior Management teams also inform us of areas regulated by external bodies This will be discussed in detail with Senior Management Teams to enable us to document more formally other relevant providers of assurance and request their reports where applicable March 2026 Principle 10 Manage Resources Standards 10.1 -10.3 Financial/Human/Technological Resource Management UK Public Sector Application Note The chief audit executive may have no ability to develop resource management approaches distinct from their organisation and tailored to the needs of the internal audit function. The chief audit executive’s ability to develop a strategy to obtain sufficient resources and address shortfalls may also be constrained by their organisation’s legal or regulatory obligations. Under these circumstances the chief audit executive will not be expected to follow the requirements of GIAS 10.1 to 10.3 (Manage Resources) if they cannot develop approaches that achieve the objectives of those standards. Instead, a chief audit executive must set out in the Charter what alternative approaches apply to the internal audit service, and then seek to manage financial, human and IT resources within those constraints. Generally conforms – The Chief Auditor is the Budget Holder for the Internal Audit Services and manages all these resources in accordance with the Council Policies. The arrangements to manage Financial/Human/Technological Resources will be included in the revised Charter and Mandate November 2025 Principle 11 - Communicate Effectively
Page 14
Appendix 1 Standard 11.1 – Building Relationships and Communicating with Stakeholders The chief audit executive must develop an approach for the internal audit function to build relationships and trust with key stakeholders, including the board, senior management, operational management, regulators, and internal and external assurance providers and other consultants. Generally conforms – 6 Monthly meeting with the Council Senior Management Teams take place. In addition, approved templates are in place for commencing an audit, reporting and associated processes in place that help build relationships and communication with stakeholders. N/A Standard 11.2 - Effective Communication The chief audit executive must establish and implement methodologies to promote accurate, objective, clear, concise, constructive, complete, and timely internal audit communications. Generally conforms – Report templates are in place for communicating the outcomes from audit engagements and reports are reviewed by Chief Auditor prior to issue. Performance indicators are in place to ensure engagements are undertaken in a timely manner. N/A Standard 11.3 – Communicating Results The chief audit executive must review, approve and communicate the results of internal audit services (including conclusions and root cause of findings) to the board and senior management periodically and for each engagement as appropriate. In addition, this standard references the possibility that a chief audit executive may be required to make a conclusion at the level of the organisation about the effectiveness of governance, risk management and/or control. In the UK public sector, a chief audit executive must prepare such an overall conclusion at least annually in support of wider governance reporting, mindful of any specific sector obligations or processes. This Generally conforms - All reports follow a template standard to ensure consistency and each recommendation and the outcome are rated. All reports are reviewed by the Chief or Assistant Chief Auditor prior to issue. Annually the Chief Auditor must provide an opinion as to whether the governance, risk and internal control measures throughout the Council are satisfactory in their Annual Report which is submitted to the Root cause analysis will be further developed and included in reports and staff training will also be provided in this area. September 2025
Page 15
Appendix 1 overall conclusion must encompass governance, risk management and control. Corporate Management Team and the ARSB. Standard 11.4 Errors and Omissions If a final engagement communication contains a significant error or omission, the chief audit executive must communicate corrected information promptly to all parties who received the original communication. Generally conforms – If this occurred the report would be recalled and an amended report issued. Standard 11.5 Communicating the Acceptance of Risks The chief audit executive must communicate unacceptable levels of risk to Senior Management and if it is not resolved, the matter must be reported to Board. Generally conforms - It would be noted on the final report that is sent to the Service Director that the service is carrying the risk by not implementing the audit recommendation and this would be noted on the ARSB summary of findings report. N/A Principle 12 Enhance Quality Standard 12.1 - Internal Quality Assessment The chief audit executive must develop and conduct internal assessments of the internal audit function’s conformance with the Global Internal Audit Standards and progress toward performance objectives. Generally conforms - There is a self- assessment tool which will be used annually for this and improvements will be action planned and reported to the ARSB. Standard 12.2 - Performance Measurement The chief audit executive must develop objectives to evaluate the internal audit function’s performance. Generally conforms - We have a suite of monthly performance indicators with targets, the results of which and the reasons for underachieving, if required, are reported to the Director of Finance and Resources and quarterly to the ARSB.
Page 16
Appendix 1 Standard 12.3 - Oversee and Improve Engagement Performance The chief audit executive must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies. Generally conforms - Weekly progress reviews are undertaken by the Supervisor for all audit engagements and formally reviewed upon completion. Review notes are prepared, answered and approved on the audit management system and the Report is then agreed upon before passing the file to the Chief or Assistant Chief Auditor for further review and to issue the draft report to management. V - Performing Internal Audit Services Principle 13 Plan Engagements Effectively Standard 13.1 - Engagement Communication Internal auditors must communicate effectively throughout the engagement including communicating the engagement plan and timing. At the end of the engagement, the findings must be agreed with service management. Generally conforms – An engagement plan is sent to the appropriate Head of Service prior to engagement and an exit meeting is held upon completion with the relevant service manager to agree the report findings. N/A Standard 13.2 - Engagement Risk Assessment Internal auditors must develop an understanding of the activity under review and gain an understanding as to how the processes are intended to operate in order to assess the relevant risks in terms of significance and likelihood of fraud Generally conforms – At the commencement of the engagement, relevant policies and procedures will be reviewed and service officers interviewed to document the system in operation. Control weaknesses and risks will be identified from the system notes and audit testing. Refresher training on identifying risks and their significance will be provided. September 2025
Page 17
Appendix 1 Standard 13.3 - Engagement Objectives and Scope Internal auditors must establish and document the objectives and scope for each engagement and be approved by the Chief Audit Executive. The scope must establish the engagement’s focus and boundaries by specifying the activities, locations, processes, systems, components, time period to be covered in the engagement, and other elements to be reviewed, and be sufficient to achieve the engagement objectives. Generally conforms – An engagement plan, detailing this information, is prepared and then approved by the Chief Auditor or Assistant Chief Auditor. It is also agreed with the relevant Head of Service prior to commencement of the engagement. N/A Standard 13.4 - Evaluation Criteria Internal auditors must identify the most relevant criteria to be used to evaluate the aspects of the activity under review defined in the engagement objectives and scope, including value for money. Generally conforms – Once we ascertain the processes in place, these are evaluated for control weaknesses and risks to enable a testing strategy to be formulated. N/A Standard 13.5 - Engagement Resources When planning an engagement, internal auditors must identify the types and quantity of resources necessary to achieve the engagement objectives. Generally conforms – The resources required are approved by the Chief Auditor and professional expert advice arranged if required. N/A Standard 13.6 - Work Program Internal auditors must develop and document an engagement work program to achieve the engagement objectives documenting the criteria to be used, tasks to be undertaken and the methodologies. This should be approved by the Chief Audit Executive Generally conforms – The system notes and work programme are recorded on our audit management system. The Engagement Supervisor reviews the work programme prior to commencement and throughout the engagement. Refresher training to be given to staff and the Engagement Supervisor will formally sign off the system notes and work programme prior to commencement. September 2025 Principle 14 Conduct Engagement Work Standard 14.1 - Gathering Information for Analyses and Evaluation To perform analyses and evaluations, internal auditors must gather information that is relevant, Generally conforms – this is detailed in our audit management system N/A
Page 18
Appendix 1 reliable and sufficient and if unable to obtain such evidence, this must be documented and any documentation obtained as evidence is also attached. Standard 14.2 - Analyses and Potential Engagement Findings Internal auditors must analyse relevant, reliable, and sufficient information and determine the condition to develop potential engagement findings. If initial analyses do not provide sufficient evidence to support a potential engagement finding, internal auditors must exercise due professional care to determine whether additional analyses are required. If internal auditors determine that no additional analyses are required and there is no difference between the criteria and the condition, the internal auditors must provide assurance in the engagement conclusion regarding the effectiveness of the activity’s governance, risk management, and control processes. Generally conforms - findings that have arisen are documented on the audit management system and the test program conclusion assessed. Further training to be carried out to emphasise the necessity to determine the root cause of differences between actual and expected and its materiality in relation to the control system. This must be recorded in the finding. September 2025 Standard 14.3 Evaluation of Findings Internal auditors must evaluate each potential engagement finding to determine its significance and where possible, collaborate with management to identify the root causes when possible, determine the potential effects, and evaluate the significance of the issue. Generally conforms - risk matrix and working papers include criteria used. Recommendation ratings in place for findings and also assurance levels for overall audits with descriptions of the risks and controls associated with each. Engagement Report template to be updated to show risk ratings. August 2025 Standard 14.4 Recommendations and Action Plans Internal auditors must determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on actions to resolve the findings, address the root cause and mitigate identified risks to an acceptable level. Generally conforms – recommendation action plans are forwarded to management and they record the action they are going to take. If the Chief Auditor feels the action is insufficient, this will be Methodology to resolve disagreements to be added to Audit Manual. March 2026
Page 19
Appendix 1 further discussed and the outcome recorded on the final report. Standard 14.5 - Engagement Conclusions Internal auditors must develop an engagement conclusion that summarises the engagement results relative to the engagement objectives and management’s objectives and includes the auditors’ professional judgment about the overall significance of the aggregated engagement findings. Generally conforms – there is an overall conclusion section in the report. N/A Standard 14.6 - Engagement Documentation Internal auditors must document information and evidence to support the engagement results and this must be reviewed by the Supervisor. All documentation must be retained in accordance with policy. Generally conforms – all work is documented and any evidence obtained attached to the file which is formally reviewed by a Supervisor. All files are retained in accordance with our retention policy. N/A Principle 15 Communicate Engagement Results and Monitor Action Plans Standard 15.1 - Final Engagement Communication For each engagement, internal auditors must develop a final communication, must be reviewed by Chief Audit Executive, that includes the engagement’s objectives, scope, recommendations and conclusions regarding the effectiveness of the governance, risk management, and control processes of the activity reviewed. The actions must identify specific owners and target completion dates, as well as acknowledgement in the report of actions initiated or completed during the engagement. Generally conforms – this information is included in our engagement report. N/A Standard 15.2 - Confirming the Implementation of Recommendations or Action Plans Internal auditors must confirm that management has implemented internal auditors’ recommendations or management’s action plans following an established methodology Generally conforms – we have a follow up process in place and the results are communicated to Senior Management. N/A
Page 20
Appendix 1 Note 1:- Assessment Descriptions Assessment Opinion Assessment Description Generally Conforms The relevant structures, policies, and procedures of the function, as well as the processes by which they are applied, conform with the requirements of the Global Internal Audit Standards in the UK Public Sector (GIAS – UKPS) in all material respects. For the Domains and Principles, this means that there is general conformance to a majority of the Standards (Requirements). There may be significant opportunities for improvement, but these must not represent situations where the function has not implemented the Principles and/or Standards (Requirements), has not applied them effectively, or has not achieved their stated objectives. As indicated above, general conformance does not require complete/perfect conformance, the ideal situation, successful practice, etc. Partially Conforms The function is making good-faith efforts to conform with the overarching requirements of the GIAS – UKPS i.e. Principles and Standards (Requirements) but falls short of achieving some major objectives. These will usually represent significant opportunities for improvement in effectively applying the elements of the GIAS – UKPS i.e. the Principles and Standards (Requirements) and achieving their objectives. Some deficiencies may be beyond the control of the function and may result in recommendations to senior management or the board of the organisation. Does not Conform The function is neither aware of nor making good-faith efforts to conform, with, or is failing to achieve many/all of the objectives of the GIAS – UKPS which includes the Principles and the Standards (Requirements). These deficiencies will usually have a significant negative impact on the function’s effectiveness and its potential to add value to the organisation. These may also represent significant opportunities for improvement, including actions by senior management or the board. Not Applicable The function is unable to comply with the requirements of the GIAS – UKPS due to circumstances outside of its control, such as internal audit team size and/or regulatory/legal requirements.