4. ARSB - Internal Audit - External Quality Assessment
Renfrewshire Council · 22 May 2023
Back to Audit, Risk and Scrutiny Board — 22 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 22 May 2022 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit – External Quality Assessment ___________________________________________________________________ 1. Summary 1.1 The Public Sector Internal Audit Standards (PSIAS) are a mandatory set of standards applying to all internal audit service providers in the public sector. 1.2 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 1.3 The external assessment of Renfrewshire Council’s Internal Audit Service has been carried out by South Ayrshire’s Council’s Internal Audit and Corporate Fraud service utilising this framework. The review concluded that the Internal Audit service fully conforms with the PSIAS, although there are some recommendations to be addressed, the report is attached at Appendix 1. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to note the external assessors report on Internal Audit’s comformance with the Public Sector Internal Audit Standards. 2.2 Members are asked to note the actions to be taken to implement the recommendations made. ___________________________________________________________________
Page 2
3. Background 3.1 To assist its members to meet the five-yearly external assessment requirement, the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) established a collaborative system of formal peer reviews. To support the peer review process, SLACIAG developed a comprehensive External Quality Assessment (EQA) framework, including an EQA Checklist and stakeholder questionnaire proforma, for assessing conformance with the PSIAS and the Local Government Application Note. 3.2 Prior to the external assessment being undertaken the Chief Auditor self- assessed Internal Audit’s comformance against the EQA Checklist and submitted relevant evidence to the external assessor. This assessment noted 3 areas for improvement and the external assessment included those along with a further 4 recommendations. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development – None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - Conformance with the PSIAS mitigates the risk of the Internal Audit Service being ineffective. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None
Page 3
________________________________________________________________ Author: Andrea McMahon
Page 4
April 2023 Page 1 EXTERNAL QUALITY ASSESSMENT 2 OF RENFREWSHIRE COUNCIL INTERNAL AUDIT SERVICE Report Recipients: Alan Russell, Chief Executive Alastair MacArthur, Director of Finance and Resources Andrea McMahon, Chief Audit Executive Cllr Andrew Doig, Chair of the Audit, Risk and Scrutiny
Page 5
EXECUTIVE SUMMARY 2 1. INTRODUCTION 1.1 The mandatory Public Sector Internal Audit Standards (PSIAS), published initially in April 2013 and updated most recently in March 2017, apply to all internal audit service providers in the UK public sector, whether in-house, provided via a shared service arrangement or outsourced. To supplement the PSIAS and provide specific guidance surrounding its application within a local government setting, the Chartered Institute of Public Finance and Accountancy (CIPFA) compiled a Local Government Application Note, which was last updated in 2019. 1.2 The objectives of the PSIAS are to define the nature of internal auditing within the UK public sector; set a basic principles for carrying out internal audit; establish a framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations; establish the basis for the evaluation of internal audit performance and drive improvement planning. 1.3 The PSIAS require the Chief Audit Executive (the Chief Auditor in Renfrewshire Council) to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation, and enable evaluation of the internal audit activity’s (Internal Audit Service in Renfrewshire Council) conformance with the PSIAS, including the Mission of Internal Audit, Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. 1.4 To assist its members to meet the five-yearly external assessment requirement, the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) established a collaborative system of formal peer reviews. This approach not only assists with ensuring that independent assessors, and their teams, have appropriate knowledge and experience of the local government internal audit environment but also removes the financial burden from councils, associated with procuring these services externally. The allocation of assessors / assessment teams to councils participating in the peer review process was undertaken autonomously, ensuring that, amongst other governing principles, local authorities with perceived / known conflicts of interest could not review one another. At the outset, assessors were required to formally declare any interests so that these could be appropriately addressed during the allocation process. South Ayrshire Council was selected to carry out the external assessment in Renfrewshire Council. 1.5 To support the peer review process, SLACIAG developed a comprehensive External Quality Assessment (EQA) framework, including an EQA Checklist for Assessing Conformance with the PSIAS and the Local Government Application Note (EQA Checklist) and a key Stakeholder Questionnaire proforma. The external assessment of Renfrewshire Council’s Internal Audit Service has been carried out by South Ayrshire’s Council’s Internal Audit and Corporate Fraud service utilising this framework. 1.6 This report provides a high level summary of requirements for each standard per the PSIAS and CIPFA Local Government Application Note and sets out the findings, conclusions and recommendations from the external assessment, which involved discussions with key members of staff, including the Chief Audit Executive, review of the most recent self-assessment carried out utilising the EQA Checklist and consideration of other relevant supporting documentation / information (Evidence Pack) including working paper files and completed stakeholder questionnaires. A comprehensive list of supporting documentation / information and completed stakeholder questionnaires considered as part of the assessment can be found at appendices B and C respectively.
Page 6
3 2. OVERALL CONCLUSION 2.1 The overall conclusion of the external assessment is that Renfrewshire Council’s Internal Audit Service fully conforms with the PSIAS. There were some components within standards 1100 – Independence and Objectivity and 1200 – Proficiency and Due Professional Care assessed as “generally conforms”. We have highlighted improvements in these areas in 2.2 below. It should be noted that four areas for improvement were identified by the Chief Auditor during their self-assessment but have been included here for completeness. A full summary of assessment, per assessment area, can be found at Appendix A. A summary of totals is as follows: Fully Conforms Generally Conforms Partially Conforms Does Not Conform TOTALS 12 2 0 0 2.2 The main areas for improvement highlighted in the report are as follows: • Updating the Internal Audit Charter to include the definition of consulting services. The updated Charter should be shared with Senior Management. • Completing the performance appraisal process for the Chief Auditor (Identified during self-assessment) • Including confirmation within the Annual Assurance statement that there are no significant threats to the independence of the Internal Audit activity. • Completing the Competency Framework exercise for the Internal Audit team. (Identified during self-assessment) • Commencing the six monthly update meetings with senior management. (Identified during self-assessment) • Updating engagement plans to include risks relevant to the audit assignment. • Completing a data cleansing exercise for audit files held on Galileo (Identified during self- assessment) 2.3 Full details of the assessment recommendations and management responses can be found in the Action Plan at Appendix D.
Page 7
4 3. SECTION A – MISSION OF INTERNAL AUDIT AND CORE PRINCIPLES The PSIAS state that the Mission of Internal Audit articulates what internal audit aspires to accomplish within an organisation, which is ‘to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight’. Taken as a whole, the Core Principles for the Professional Practice of Internal Auditing, as set out in the PSIAS, articulate internal audit effectiveness. For an internal audit Service to be considered effective, all Core Principles should be present and operating effectively. Failure to achieve any of the Core Principles would imply that an internal audit activity was not as effective as it could be in achieving the Mission of Internal Audit. 3.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used, along with specific consideration surrounding the achievement of the Core Principles, to conclude that the Internal Audit Service at Renfrewshire Council fully conforms with accomplishing the Mission of Internal Audit as detailed above. 4. SECTION B – DEFINITION OF INTERNAL AUDITING The PSIAS state that internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 4.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used to conclude that the Internal Audit Service at Renfrewshire Council fully conforms with the definition of Internal Auditing as detailed above. The main reason for this assessment is that across all the standards a high level of compliance was noted with the Internal Audit function operating in line with expectations overall. This was evidenced through a variety of means including the Internal Audit Charter, Financial Codes and audit manual, examination of audit documents and consideration of the regular reporting of Internal Audit progress and performance to key stakeholders. Stakeholder Questionnaires support this conclusion. 5. SECTION C – CODE OF ETHICS The PSIAS state that the purpose of the Institute of Internal Auditor’s Code of Ethics is to promote an ethical culture in the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, control and governance. Internal auditors in UK public sector organisations must conform to the Code of Ethics as set out in the PSIAS. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. 5.1 Evidence obtained from assessing conformance with other standards in the PSIAS, in particular the Attribute Standards 1000 – Purpose Authority and Responsibility, 1100 – Independence and Objectivity, 1200 – Proficiency and Due Professional Care and Professional Standards 2000 – Managing the Internal Audit Activity and 2300 – Performing the Engagement, has been used to conclude that Renfrewshire Council’s Internal Audit Service fully conforms with the requirement to comply with the Code of Ethics. Stakeholder Questionnaires support this conclusion. There is scope to further improve existing arrangements in this area through implementation of the actions included within the action plan at Appendix D.
Page 8
5 6. SECTION D – ATTRIBUTE STANDARDS Attribute Standards apply to organisations and individual internal auditors providing the internal audit services in a local authority. 6.1 1000 - Purpose, Authority, and Responsibility The PSIAS state that the purpose, authority and responsibility of the internal audit activity must be formally defined in an Internal Audit Charter, consistent with the Mission of Internal Audit and the mandatory elements of the International Professional Practices Framework. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval. The internal audit charter must also: • define the terms ‘board’ and ‘senior management’ for the purposes of internal audit activity; • cover the arrangements for appropriate resourcing; • define the role of internal audit in any fraud-related work; and • describe safeguards to limit impairments of independence or objectivity if internal audit or the chief audit executive undertakes non-audit activities. 6.1.1 The current Renfrewshire Council’s Internal Audit Charter was last approved by the Audit, Risk and Scrutiny Board on 23 August 2021. The Internal Audit Charter is periodically reviewed with the most recent review taking place in September 2022. There were no changes made to the Charter following this review which was reported to the Audit, Risk and Scrutiny Board on 14 November 2022. The Chief Auditor advised that, given the climate at the time when the Internal Audit Charter was last approved (August 2021) and the minimal changes made to it at that point, it was not communicated separately to the Corporate Management Team. 6.1.2 The Internal Audit Charter sets out the purpose, authority and responsibility of the Internal Audit service in Renfrewshire Council. It also defines the nature of assurance services, internal audits’ position in the organisation and information in relation to the relationship between the Chief Auditor and the Audit, Risk and Scrutiny Board. However it does not include a definition of consulting activities. 6.1.3 It is recommended that the Internal Audit Charter is updated to include the definition of consulting activities and, once approved by the Audit, Risk and Scrutiny Board, the updated Charter should be shared with the Corporate Management Team. (Action 1) 6.1.4 Having considered the findings above, it has been concluded that the Internal Audit Service at Renfrewshire Council fully conforms with Standard 1000 on Purpose, Authority and Responsibility. 6.2 1100 - Independence and Objectivity The internal audit activity must be independent and internal auditors must be objective in performing their work. Various aspects of independence and objectivity are covered in this standard as well as 1200, including reporting functional lines of the CAE, the relationship between the CAE and the board and any impairment to individual internal auditors’ objectivity or independence. Reporting and management arrangements must be put in place that preserve the CAE’s independence and objectivity, in particular with regard to the principle that the CAE must be independent of the audited activities. 6.2.1 The Internal Audit Service reports functionally to the Audit, Risk and Scrutiny Board and administratively to the Director of Finance and Resources, who is a member of the Council’s Corporate Management Team. The Chief Auditor has direct and unrestricted access and the Chair of the Audit, Risk and Scrutiny Board and the Chief Executive regarding any matters of concern that could place the Council in a position where the risks it faces are unacceptable and this has been confirmed through the completed
Page 9
6 Stakeholder Questionnaires. These reporting / access arrangements are clearly defined in the Internal Audit Charter as are safeguards to limit impairment of independence or objectivity. 6.2.2 It was confirmed that the Chief Internal Auditor’s independence is supported by Council arrangements to prevent inappropriate influence by those subject to audit including; a Recruitment Policy, Employee Code of Conduct, Disciplinary Procedures and a Performance Appraisal processes. However it was established that the performance appraisal for the Chief Auditor has not been completed since pre Covid (March 2020). 6.2.3 In support of organisational independence, the Chief Auditor attends the Audit, Risk and Scrutiny Board meetings to present all internal audit reports to Elected Members. The reports are all submitted in the Chief Auditor’s name. Within the stakeholder questionnaires, both the Chief Executive and the Director of Finance and Resources stated Internal Audit was only partly considered to be a key strategic partner with a high profile with the organisation. However the Director of Finance and Resources also noted that they will be aiming to support the team in this over the coming months. 6.2.4 The Chief Auditor has operational responsibility for Risk Management. The Internal Audit Charter states “Where the Chief Auditor has responsibility for operational activities the periodic review of these activities will be conducted by parties independent of the Internal Audit function”. The Risk Management Service was last reviewed in 2018 and evidence was provided that a third party completed this audit. 6.2.5 Although the Internal Audit Charter sets out the arrangements for independence, it was found that neither the Internal Audit Annual Report or the progress and performance reports to the Audit, Risk and Scrutiny Board, provide additional ongoing and explicit confirmation that there have been no significant threats to the independence of the internal audit activity, such as inappropriate scope or resource limitations. The Chief Auditor advised that threats to the independence of the internal audit activity is reported through the quarterly progress and performance reports to the Audit, Risk and Scrutiny Board. There were no such threats noted during the period of the assessment. 6.2.6 It was noted that within Renfrewshire Council the Chief Auditor is required to confirm any interests on an annual basis and this is recorded in a Register of Interests. All other employees within the Internal Audit service are required to comply with the Code of Conduct. The Internal Audit Manual states all staff must adhere to Renfrewshire Council’s Employee Code of Conduct which details the process to be followed if a potential conflict of interest arises. 6.2.7 It is recommended that; • A performance appraisal is completed for the Chief Auditor. The appraisal should include feedback from at least the Chief Executive and the Chair of the Audit, Risk and Scrutiny Board and should be countersigned by an independent party. (Action 2) • The Internal Audit Annual report should include explicit confirmation that there have been no significant threats to the independence of the internal audit activity, such as inappropriate scope or resource limitations.. (Action 3) 6.2.8 Renfrewshire Council’s Internal Audit Service generally conforms with Standard 1100 on Independence and Objectivity. 6.3 1200 - Proficiency and Due Professional Care The CAE must be professionally qualified, suitably experienced and responsible, in accordance with the organisation’s human resources processes, for recruiting appropriate staff. He or she is responsible for ensuring that up-to-date job descriptions exist, reflecting roles and responsibilities, and that person specifications define the required qualifications, competencies, skills, experience and personal attributes.
Page 10
7 The CAE should periodically assess individual auditors’ skills and competencies against those set out in the relevant job descriptions and person specifications. Any training or development needs identified should be included in an appropriate ongoing development programme that is recorded and regularly reviewed and monitored. In addition, all internal auditors have a personal responsibility to undertake a programme of continuing professional development (CPD) to maintain and develop their competence. This may be fulfilled through requirements set by professional bodies or through the organisation’s own appraisal and development programme. Auditors should maintain a record of such professional training and development activities. The internal audit activity should be appropriately resourced to meet its objectives. It should have appropriate numbers of staff in terms of grades, qualifications, personal attributes and experience or have access to appropriate resources in order to meet its objectives and to comply with these standards. The PSIAS states that the CAE must obtain competent advice and assistance if the activity is unable to perform all or part of an engagement. 6.3.1 The Chief Auditor holds a relevant professional qualification and is suitably experienced, with over 20 years internal audit experience within a Scottish local government environment. The Chief Auditor is a member of SLACIAG and regularly attends and contributes to meetings. Renfrewshire Council’s Internal Audit Service is represented on both SLACIAG Sub-groups, the Computer Audit Sub-Group (CASG) and the Scottish Local Authorities Investigators Group (SLAIG),. 6.3.2 To support the Chief Auditor in Renfrewshire Council’s Internal Audit Service there is one Assistant Chief Auditor and 2 Senior Auditors these posts require to be CCAB or IIA qualified. There are a total of 6 members of staff in the Internal Audit Service, including the Assistant Chief Auditor and the 2 Senior Auditors. The Internal Audit Service delivers internal audit services to the Renfrewshire Integration Joint Board, the Renfrewshire Valuation Joint Board and to One ren. There are 3 dedicated Corporate Counter Fraud Officer within the service and where the service does not have the specialist skills for ICT audits a budget is available to the Chief Auditor to use external providers to undertake the assignments. 6.3.3 The Internal Audit Service has a competency framework in place which should be completed every two years. Supplementary questions have been added to the framework dependent on the employee’s role with the audit team. The process results in a personal development plan for each member of staff. However we were advised that completion of this process was delayed due to Covid working restrictions as the refresher training which was identified through the competency framework could not be delivered. This training has now been delivered. The Chief Auditor advised that it is intended to issue competency frameworks to all Internal Audit Staff for completion in 2023/24 which will result in new personal development plans being prepared. 6.3.4 The Internal Audit Service is represented on a number of corporate groups, including the Corporate Risk Management Group, the Information Management Governance Group and the Prevent Sub-group. 6.3.5 Renfrewshire Council is an accredited employer for the professional accountancy bodies and all members of the Internal Audit Service who are members of a professional accountancy body have specific CPD requirements to adhere to. 6.3.6 It is recommended that the competency framework is reissued to the audit team in 2023/24 and every two years thereafter. (Action 4) 6.3.8 The Stakeholder Questionnaires confirmed that the Chief Auditor demonstrates sufficient knowledge and experience and that all members of the Internal Audit Service exercise due professional care.
Page 11
8 6.3.9 Renfrewshire Council’s Internal Audit Service generally conforms with standard 1200 on Proficiency and Due Professional Care. 6.4 1300 - Quality Assurance and Improvement Programme The PSIAS state that the Chief Audit Executive must develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outside the organisation, and enable evaluation of the internal audit activity’s conformance with the PSIAS, including the Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. The public sector requirement in the PSIAS states that results of the QAIP and progress against any improvement plans must be reported in the annual report. 6.4.1 Internal audit reports are reviewed by the Chief Auditor or Assistant Chief Auditor prior to issue and working papers are, in general, reviewed by one of the Senior Internal Auditors. Where the assignment is carried out by the Senior Internal Auditor, the Assistant Chief Auditor will review the working paper file. 6.4.2 Client feedback on the Internal Audit is actively pursued by the Internal Audit Service at audit planning meeting. In addition, the Chief Auditor advised that this will also be included in discussions with senior management during the six monthly meetings planned to commence in 2023. 6.4.3 A suite of KPIs are prepared and reported to the Director of Finance and Resources and the Audit, Risk and Scrutiny Board. The KPIs are designed to measure performance in the delivery of the assignments within audit plan and progress of the overall plan. 6.4.4 A self-assessment against the PSIAS was carried out by the Chief Auditor, utilising the EQA checklist in October 2022. The results of the self-assessment will be reported to the Audit, Risk and Scrutiny Board along with the EQA2 external assessment results. 6.4.5 Renfrewshire Council’s Internal Audit Service fully conforms with Standard 1300 on Quality Assurance and Improvement Programme. 7. SECTION E – PERFORMANCE STANDARDS Performance Standards describe the nature of the internal audit services being provided and provide criteria against which the performance of an internal audit function can be measured. 7.1 2000 - Managing the Internal Audit Activity The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organisation. The internal audit activity is effectively managed when it achieves the purpose and responsibility included in the internal audit charter, it conforms with the PSIAS, its individual members conform with the Code of Ethics and the PSIAS and it considers trends and emerging issues that could impact the organisation. The internal audit activity adds value to the organisation and its stakeholders when it considers strategies, objectives and risks; strives to offer ways to enhance governance, risk management, and control processes; and objectively provides relevant assurance.
Page 12
9 7.1.1 An annual Internal Audit Plan is compiled by the Chief Auditor outlining the planned programme of work to be undertaken. A Planning Protocol is in place to help guide the development of the annual plan. The protocol details the pre-plan preparation which includes review of the audit entities and audit universe and scrutiny of the strategic and corporate risk registers, other key Council documents e.g. the Council Plan, external audit and other assurance body reports and other Local Authority Internal Audit Plans. It also details the parties to be consulted on the plan which include the Chief Executive, the Corporate Management Team, external audit, Senior Managers for associated bodies and Audit, Risk and Scrutiny Board Members. 7.1.2 The Chief Auditor and Assistant Chief Auditor meets with service Senior Management Team prior to preparation of the annual plan. 7.1.3 The draft plan is shared with the Chief Executive and the Corporate Management Team for comment prior to being submitted for approval to the Audit, Risk and Scrutiny Board. Reports detailing progress towards completion of the Internal Audit plan are presented to the Audit, Risk and Scrutiny Board on a quarterly basis. 7.1.4 It was noted that it was the intention of the Chief Auditor to also have six monthly meeting with services Senior Management Team to discuss the progress against the plan. However due to Covid working restrictions and long term absences within the Internal Audit Service these meetings have not yet commenced. 7.1.5 Completed stakeholder questionnaires from the Chief Executive, the Director of Finance and Resources and the Chair and Vice Chair of Audit, Risk and Scrutiny Board confirm that they consider that the Internal Audit function adds value and that they are given appropriate opportunity to feed into the audit planning process. 7.1.6 It is recommended that the six monthly update meetings with services Senior Managers commence in 2023 as planned. (Action 5) 7.1.7 Renfrewshire Council’s Internal Audit Service fully conforms with Standard 2000 on Managing the Internal Audit Activity. 7.2 2100 - Nature of Work The internal audit activity must evaluate and contribute to the improvement of the organisation’s governance, risk management, and control processes using a systematic, disciplined, and risk-based approach. Internal audit credibility and value are enhanced when auditors are proactive and their evaluations offer new insights and consider future impact. More specifically, the internal audit activity must assess and make appropriate recommendations to improve the organisation’s governance processes, evaluate the effectiveness and contribute to the improvement of risk management processes and assist the organisation in maintaining effective controls by evaluating their efficiency and effectiveness and promoting continuous improvement. 7.2.1 The Internal Audit Charter, Audit Manual and annual plan set out how the internal audit function will evaluate the adequacy and effectiveness of controls and delivery of the plan via individual audit reports and the annual assurance report confirms this approach is delivered in practice. The Council’s Risk Manager reports to Chief Auditor who is a member of the Corporate Risk Management Group. 7.2.3 Renfrewshire Council’s Internal Audit Service fully conforms with Standard 2100 on Nature of Work. 7.3 2200 - Engagement Planning Internal auditors must develop and document a plan for each engagement, including the
Page 13
10 engagement’s objectives, scope, timing and resource allocations. The plan must consider the organisation’s strategies, objectives and risks relevant to the engagement. The CIPFA Local Government Application note states that for each engagement, a brief should be prepared, discussed and agreed with relevant managers. The brief should establish the objectives, scope and timing for the assignment and its resource and reporting requirements. Audit work should be undertaken using a risk-based audit approach. 7.3.1 An Engagement Plan is prepared and issued for each audit contained within the Annual Audit Plan. This sets out the objectives, scope, timetable and resources allocated for the assignment. The client service is provided with an opportunity to comment on the proposed brief prior to the start of the audit. 7.3.2 An audit management system, Galileo, is used to by Renfrewshire Council’s Internal Audit Service. The system is used to create risk matrices for each assignment which details the risks, controls and test programme for each assignment. The auditors record the findings of the tests into Galileo and attach all relevant documentation. 7.3.3 A review of the documentation provided during this assessment confirmed this process. 7.3.4 PSIAS requires the engagement plan to consider the organisation’s strategies, objectives and risks relevant to the engagement. Links to the organisations strategies are included within the annual plan, however, although risks are recorded within the assignment risk matrix within Galileo, they are not included within the engagement plan. 7.3.5 It is recommended that consideration is given to including the risks relevant to the audit assignment within the engagement plans. (Action 6) 7.3.6 Renfrewshire Council’s Internal Audit Service Fully conforms with Standard 2200 on Engagement Planning. 7.4 2300 - Performing the Engagement Internal auditors must identify, analyse, evaluate and document sufficient information to achieve the engagement’s objectives. At each stage of the audit, auditors should consider what specific work needs to be conducted and evidence needs to be gathered to achieve the engagement objectives and support an independent and objective audit opinion. Systems should be in place to ensure that auditors obtain and record, within the working papers, sufficient evidence to support their conclusions, professional judgements and recommendations. Working papers should always be sufficiently complete and detailed to enable an experienced internal auditor with no previous connection with the audit to ascertain what work was performed, re-perform it if necessary and support the conclusions reached. The CAE should also specify how long all audit documentation should be retained, whether held on paper or electronically. All audit work should be subject to an appropriate internal quality review process. Internal auditors must be alert to the possibility of intentional wrongdoing, errors and omissions, poor value for money, failure to comply with management policy and conflicts of interest when performing their individual audits. They must also have sufficient knowledge to identify indicators that fraud or corruption may have been committed. 7.4.1 The Internal Audit Manual, October 2021, sets out the procedure in relation to undertaking a planned audit, including preparing working papers and setting up working paper files. The manual also included details for dealing with other types of work including investigations and consultancy assignments. 7.4.2 Standard electronic working papers are used and are held together with supporting information in the audit management system Galileo.
Page 14
11 7.4.3 Through examination of documentation provided during this assessment it was confirmed that there are adequate arrangements for performing and supervising audit work are in place. Audit files are reviewed by Senior Auditors and a final review is carried out by either the Chief Auditor or the Assistant Chief Auditor prior to issue of the draft report. 7.4.4 A Council Wide Records Management Policy and an Internal Audit Retention Schedule is in place. The Chief Auditor advised that files stored on the Internal Audit network drive have been deleted in line with the Retention Schedule but that no records have been deleted from the Galileo system as yet. The Chief Auditor advised that further investigation regarding archiving the files held on Galileo is required. 7.4.5 It is recommended that a data cleansing exercise is undertaken on the files within Galileo to ensure the Internal Audit service is complying with the Council’s Records Management Policy and the Internal Audit Retention Schedule. (Action 7) 7.4.6 Renfrewshire Council’s Internal Audit Service fully conforms with Standard 2300 on Performing the Engagement. 7.5 2400 - Communicating Results The basic aims of every internal audit report should be to: • give an opinion on the risk and controls of the area under review, building up to the annual opinion on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control; • prompt management to implement the agreed actions for change leading to improvement in the control environment and performance; and • provide a formal record of points arising from the audit and, where appropriate, of agreements reached with management, together with appropriate timescales. Each report should include the scope and purpose of the audit to help the reader to understand the extent, or limitations, of the assurance(s) provided by the report. During the course of the audit, key issues should be brought to the attention of the relevant manager to enable them to take corrective action and to avoid surprises at the closure stage. Before issuing the final report, the internal auditor should normally discuss the contents with the appropriate levels of management to confirm the factual accuracy, to seek comments and to confirm the agreed management actions. A draft report is useful for this purpose. Recommendations should be prioritised according to risk. The recommendations and the resultant management action plans should be agreed prior to the issue of the final report. Any areas of disagreement between the internal auditor and management that cannot be resolved by discussion should be recorded in the action plan and the residual risk highlighted. Those weaknesses giving rise to significant risks that are not agreed should be brought to the attention of a more senior level of management and the board. As set out in the PSIAS, the CAE must deliver an annual internal audit opinion and report that can be used by the organisation to inform its annual governance statement. This must include the annual internal audit opinion concluding on the overall adequacy and effectiveness of the organisation’s governance, risk and control framework, a summary of the audit work from which the opinion is derived (including reliance placed on work by other assurance bodies); and a statement of conformance with the PSIAS and the results of the internal audit QAIP. 7.5.1 The Internal Audit service prepares draft reports which include details of the objectives and scope of the audit, an audit opinion, recommendations which include a risk rating against each recommendation. Reports are reviewed by either the Chief Auditor or the Assistant Chief Auditor before being issued.
Page 15
12 7.5.2 Prior to the issue of the draft report, exit meetings are held with operational staff within the service to confirm the factual accuracy of the findings and to ensure recommendations made are feasible. Draft reports are the issued to the client service management who are given one month to respond to confirm the factual accuracy, provide any comments on the report and provide management responses including responsible officers and implementation dates for agreed actions. Final reports are issued to the appropriate service Director and Head of Service, and other relevant officers are required. A Report Issue Process is in place which lists the relevant officers who should receive copies of final reports. A Summary of Internal Audit Reports issued is submitted to the Audit, Risk and Scrutiny Board on a quarterly basis. This report provides Members with a summary of the findings and conclusions of completed audit engagements. The report includes a Committee Summary for each assignment which details the audit objectives and scope, the key audit assurances and risks, the overall audit opinion and the management commentary. 7.5.3 An Internal Audit Annual Report including the Annual Assurance Statement is presented to the Audit, Risk and Scrutiny Board and includes details of the individual audit assignments undertaken during the year which contributes to the opinion presented in the report. 7.5.4 All Stakeholder’s who complete a questionnaire agreed that Internal Audit findings and recommendations were valued by stakeholders and helped the Council achieve its objectives. 7.5.5 Renfrewshire Council’s Internal Audit Service fully conforms with Standard 2400 on Communicating Results. 7.6 2500 - Monitoring Progress The PSIAS place responsibility for monitoring progress with the CAE to ensure that management actions have been effectively implemented or, if not, that senior management have accepted the risk of not taking action. The CAE must, therefore, implement a follow-up process for ensuring the effective implementation of audit results or ensuring senior management are aware of the consequences of not implementing an action point and are prepared to accept the risk of such consequences occurring. The results of this process should be communicated to the board. The CAE should develop escalation procedures for cases where agreed actions have not been effectively implemented by the date agreed. These procedures should ensure that the risks of not taking action have been understood and accepted at a sufficiently senior management level. The effective involvement of the board in the follow-up process is critical to ensuring that it works. The CAE should consider revising the internal audit opinion in light of findings from the follow-up process. The findings of follow-up reviews should inform the planning of future audit work. 7.6.1 The process for monitoring progress of internal audit recommendations is detailed within the Internal Audit Manual. All recommendations are recorded in the Internal Audit management system, Galileo and an annual exercise is undertaken to identify the actions status. The results of this exercise and details of recommendations not yet implemented are communicated to service Directors. The overall results of the exercise along with the details of the critical recommendations not implemented by the due date are reported to the Corporate Management Team and Members of the Audit, Risk and Scrutiny Board by the Chief Auditor. 7.6.2 The 2022-23 Annual Internal Audit Plan included an allocation of time for follow up engagements. 7.6.4 Renfrewshire Council’s Internal Audit Service fully conforms with Standard 2500 on Monitoring Progress.
Page 16
13 7.7 2600 - Communicating the Acceptance of Risks When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organisation, they must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, they must communicate the matter to the board. It is not the responsibility of the chief audit executive to resolve the risk. 7.7.1 As detailed in the Audit Manual the Chief Auditor or Assistant Chief Auditor should be notified by the Senior Auditor where management are willing to accept a level of risk. If the Chief Auditor is of the opinion that this may be unacceptable to the organisation, they will discuss the matter with the appropriate Service Director and any other appropriate member of the Corporate Management Team. If the Chief Auditor determines the matter has not been resolved, the Chief Auditor will communicate the matter to the Audit, Risk and Scrutiny Board. 7.7.2 Renfrewshire Council’s Internal Audit Service fully conforms to the Standard on Communicating the Acceptance of Risk. Cecilia McGhee Chief Internal Auditor South Ayrshire Council April 2023
Page 17
14 APPENDIX A – SUMMARY OF ASSESSMENT REF PAGE No. ASSESSMENT AREA Fully Conforms Generally Conforms Partially Conforms Does Not Conform Section A Mission of Internal Audit and Core Principles ✓ Section B Definition of Internal Auditing ✓ Section C Code of Ethics ✓ Section D ATTRIBUTE STANDARDS 1000 Purpose, Authority and Responsibility ✓ 1100 Independence and Objectivity ✓ 1200 Proficiency and Due Professional Care ✓ 1300 Quality Assurance and Improvement Programme ✓ Section E PERFORMANCE STANDARDS 2000 Managing the internal Audit Activity ✓ 2100 Nature of Work ✓ 2200 Engagement Planning ✓ 2300 Performing the Engagement ✓ 2400 Communicating Results ✓ 2500 Monitoring Progress ✓ 2600 Communicating the Acceptance of Risks ✓ TOTALS ☐
Page 18
15 APPENDIX B – EVIDENCE PACK • The Internal Audit Charter 2021 • Internal Audit Manual • Annual Internal Audit Plan 2022 -23 • Internal Audit Annual Report 2021-22 • Report Issue Protocol • Annual Governance Statement • Scheme of delegated functions • Financial Regulations • Financial Codes November 2018 • Defalcation Procedures • Disciplinary Procedures • Code of Conduct for all Renfrewshire Employees 2018 • Code of Conduct for Officers on acceptance of gifts and hospitality • Data protection policy • Information security policy • Counter Fraud and Corruption Policy • Expressing Concerns outwith line management (Whistleblowing) • Board Report Guidance • Audit, Risk and Scrutiny Board Agendas and Minutes and Internal Audit progress/update board reports • Recruitment policy • Audit staff job descriptions and person specifications • Other information reviewed included; standard templates used throughout the audit process, audit working papers, reports and correspondence with audit clients in relation to audit assignments.
Page 19
16 APPENDIX C – STAKEHOLDER QUESTIONNAIRES Stakeholder questionnaires were completed by the following key members of staff and Elected Members: • Alan Russell, Chief Executive • Alastair Macarthur, Director of Finance and Resources • Councillor Andrew Doig, Chair of Audit, Risk and Scrutiny Board • Councillor Kevin Montgomery, Vice Chair of Audit, Risk and Scrutiny Board
Page 20
17 APPENDIX D – ACTION PLAN No. Para Recommendation Management Response Responsible Officer / Agreed Completion Date 1 6.1.3 The Internal Audit Charter should be updated to include the definition of consulting activities and, once approved by the Audit, Risk and Scrutiny Board, the updated Charter should be shared with the Corporate Management Team. The Internal Audit Charter has now been updated to include the definition of consulting activities. The updated charter will be presented to the CMT on 2 May 2023 and to the ARSB on 22 May 2023. Chief Auditor May 2023 2 6.2.7 A performance appraisal is completed for the Chief Auditor. The appraisal should include feedback from at least the Chief Executive and the Chair of the Audit, Risk and Scrutiny Board and should be countersigned by an independent party. The corporate framework for performance appraisal is currently being reviewed and future appraisals will be conducted following any revised methodology. In the meantime, a review of the current objectives and personal development plan will be undertaken by the Director of Finance and Resources and feedback will be sought from the Chief Executive and the Chair of the ARSB. Chief Auditor and Director of Finance & Resources March 2024 3 6.2.7 The Internal Audit Annual report should include explicit confirmation that there have been no significant threats to the independence of the internal audit activity, such as inappropriate scope or resource limitations.. The Annual Report for 2022/23 includes a statement that there have been no threats to the independence of Internal Audit and that the section has been adequately resourced. The Annual Report will be presented to the CMT on 2 May 2023 and to the ARSB on 22 May 2023. Chief Auditor May 2023 4 6.3.6 The competency framework should be reissued to the audit team in 2023/24 and every two years thereafter. Further risk based auditing training is planned for the forthcoming months, thereafter, the competency framework will be issued to the team for completion and individual personal development plans will follow. This process will resume to be completed every two years Assistant Chief Auditor March 2024 5 7.1.6 Six monthly update meetings with services Senior Managers should commence in 2023 as planned. Meetings will be arranged with all Senior Management Teams on a 6 monthly basis. It is planned that the meetings will be August and February each year. Chief Auditor August 2023
Page 21
18 6 7.3.5 Consideration should be given to including the risks relevant to the audit assignment within the engagement plans. As stated previously further risk based auditing training is planned and thereafter risks will be included on engagement plans. Chief Auditor March 2024 7 7.4.5 A data cleansing exercise on the files within Galileo should be undertaken to ensure the Internal Audit service is complying with the Council’s Records Management Policy and the Internal Audit Retention Schedule A data cleansing exercise will be undertaken to ensure that Internal Audit complies with the Council and Section Retention Schedules. Chief Auditor December 2023 Critical Significant Routine