5. ARSB - Internal Audit Charter
Renfrewshire Council · 22 May 2023
Back to Audit, Risk and Scrutiny Board — 22 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 22 May 2022 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Charter ___________________________________________________________________ 1. Summary 1.1 The Internal Audit Charter was last updated in August 2021. 1.2 This report presents a revised Internal Audit Charter (Appendix 1) that has been updated to take account of the recommendation arising from our External Quality Assessment to include the definition of consulting activities. 1.3 The revised reporting arrangements agreed with Scotland Excel, whereby Internal Audit now reports to the Executive Sub-Committee rather than the Joint Board has also been reflected. 1.3 No other changes are required to the Internal Audit Charter at this time. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the revised Internal Audit Charter. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development – None
Page 2
3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - Conformance with the PSIAS mitigates the risk of the Internal Audit Service being ineffective. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Andrea McMahon
Page 3
INTERNAL AUDIT CHARTER 1 INTRODUCTION: Internal Audit is an independent and objective assurance and consulting activity designed to add value and improve the operations of Renfrewshire Council. It assists Renfrewshire Council in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes. MISSION: To enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. DEFINITION OF ROLES: The Public Sector Internal Audit Standards require that the Internal Audit Charter defines the terms ‘board’, ‘senior management’ and ‘Chief Audit Executive’ in relation to the work of Internal Audit. For the purposes of the Internal Audit work function at Renfrewshire Council: • the ‘board’ refers to the Audit, Risk and Scrutiny Board which has delegated responsibility for overseeing the work of Internal Audit; • ‘senior management’ is defined as the Council’s Corporate Management Team, all audit reports are issued to a member of the CMT; and • ‘Chief Audit Executive’ refers to the Chief Auditor. PROFESSIONALISM: Renfrewshire Council’s Internal Audit service will comply with the PSIAS which encompasses the mandatory elements of the Institute of Internal Auditors (IIA) International Professional Practices Framework (IPPF), including the Definition of Internal Auditing, the Core Principles for the Professional Practice of Internal Audit, the Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing (Standards). This mandatory guidance constitutes the principles of the fundamental requirements for the professional practice of internal auditing in the public sector and for evaluating the effectiveness of the internal audit activity’s performance. The internal audit service will adhere to Renfrewshire Council’s relevant policies and procedures and the internal audit manual which sets out the internal audit activity’s standard operating procedures.
Page 4
2 A programme of Continuous Professional Development (CPD) is maintained for all staff working on audit engagements to ensure that auditors maintain and enhance their knowledge, skills and audit competencies. AUTHORITY: The authority of Internal Audit is set out in the Council’s Financial Regulations and Codes. Internal Audit will safeguard all information obtained in the carrying out of its duties and will only use it for the purposes of an audit, investigation, or consultancy work. Internal Audit has authorised full, free, and unrestricted access to any and all of Renfrewshire Council’s records, physical properties, and personnel pertinent to carrying out any engagement. Internal Audit will make no disclosure of any information held unless this is authorised or there is a legal or professional requirement to do so. All employees are requested to assist the internal audit activity in fulfilling its roles and responsibilities. The internal audit activity will also have free and unrestricted access to the Board. ORGANISATION: The Chief Auditor will report functionally to the Board and administratively (i.e. day to day operations) to the Director of Finance and Resources. The Chief Auditor will communicate and interact directly with the Board, including in Board meetings and between Board meetings as appropriate. The Chief Auditor may report direct to the Chief Executive, Board members or the Council regarding any matters of concern that could place the Council in a position where the risks it faces are unacceptable or the independence of Internal Audit is under threat. INDEPENDENCE AND OBJECTIVITY: Internal Audit is an independent review activity. In conducting its activities, Internal Audit activity will remain free from any undue influence or other pressure affecting its actions and reporting. This includes matters of audit selection, scope, procedures, frequency, timing, or report content. Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. It is the responsibility of the Council’s managers to ensure that the management of the areas under their control is adequate and effective and that their services have a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. Internal auditors will have no direct operational responsibility or authority over any of the activities audited. Where the Chief Auditor has responsibility for operational activities the periodic review of these activities will be conducted by parties independent of the Internal Audit function. Internal auditors must exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. Internal auditors must make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments. The Chief Auditor will confirm to the board, at least annually, the organisational independence of the internal audit activity.
Page 5
3 RESPONSIBILITY: The Council’s Internal Audit Service adds value to the Council by providing objective and relevant assurance, and contributing to the effectiveness and efficiency of governance, risk management and control processes. The scope of internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives. This includes: • Independent review and appraisal of the control environment throughout the organisation. • Providing assurance to management and the Board that the established systems ensure compliance with those policies, plans, procedures, laws, and regulations which could have a significant impact on the organisation. • Evaluating the means of safeguarding assets and, as appropriate, verifying the existence of such assets. • Evaluating the effectiveness and efficiency with which resources are employed. • Evaluating operations or projects to ascertain whether results are consistent with established objectives and goals and whether the operations or projects are being carried out as planned. • Evaluating the reliability and integrity of information and the means used to identify, measure, classify, and report such information. • Supporting the Council to improve its internal control, governance and risk management processes. • Evaluating the extent to which risks have been identified and managed to achieve the Council’s objectives. • Working in partnership with external auditors and other review bodies to coordinate activities with internal audit to avoid duplication and seek to rely on the work of these other assurance providers where professional standards and the nature and quality of the work they have undertaken would make it appropriate to do so. • Undertaking consulting and advisory services related to governance, risk management and control as appropriate for the organisation. • Supporting the Chief Executive (Head of Paid Services), the Director of Finance and Resources (Chief Financial Officer) and the Head of Corporate Governance (Monitoring Officer) in the discharge of their statutory duties; • Encouraging a culture of personal and corporate responsibility and accountability through the promotion of anti-fraud and corruption and ethical values.
Page 6
4 • Having the right of access to examine the accounts and other financial records and data of external organisations as set out in the conditions of funding or other agreement. • Investigating any suspicion of fraud, irregularity or corrupt practice in accordance with the Council’s Defalcation procedures. CONSULTANCY SERVICES The PSIAS defines consulting services as ‘Advisory and client related service activities, the nature and scope of which are agreed with the client, are intended to add value and improve an organisation’s governance, risk management and control processes without the internal auditor assuming management responsibility. Examples include counsel, advice, facilitation and training’. • Consultancy and advice services, may be undertaken from time to time at the request of senior management. A provision is included in the annual audit plan for this type of work; • when undertaking such work auditors will maintain their independence and objectivity and will not take on management responsibility for the project; and • any significant consultancy assignments will be reported separately to the audit committee. Any significant consulting exercise, not included in the annual audit plan, will be approved by the Audit, Risk and Scrutiny Board. Significant is defined as any single assignment equivalent to 5% of annual planned days. INTERNAL AUDIT PLAN: The authority for the production and execution of the audit plan rests with the Chief Auditor. The internal audit plan will be developed based on a prioritisation of the audit universe using a risk- based methodology, including input of senior management and the Board. At least annually, the Chief Auditor will submit to senior management and the Board an internal audit plan for review and approval. The internal audit plan will consist of a work schedule as well as resource requirements for the next financial year. The Chief Auditor will communicate the impact of any resource limitations and any significant deviation from the approved internal audit plan will be communicated to senior management and the Board through periodic performance reports. REPORTING AND MONITORING: A written report will be prepared and issued by the Chief Auditor or designee following the conclusion of each internal audit engagement and will be distributed as appropriate. The results of each internal audit engagement will also be communicated to senior management and the Board. The internal audit report may include management’s response and corrective action taken or to be taken in regard to the specific findings and recommendations. Management's response, whether included within the original audit report or provided thereafter by management of the audited area should include a timetable for anticipated completion of action to be taken and an explanation for any corrective action that will not be implemented.
Page 7
5 The internal audit activity will be responsible for appropriate follow-up on engagement findings and recommendations. PERIODIC ASSESSMENT: The Chief Auditor will at least annually, report to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. Annual reporting will also provide an annual audit opinion on the overall adequacy and effectiveness of the Council’s internal control environment, and include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters needed or requested by senior management and the Board. In addition, the Chief Auditor will communicate to senior management and the Board on the internal audit activity’s quality assurance and improvement programme, including results of internal assessments and external assessments conducted at least every five years. PROVISION OF SERVICES TO ASSOCIATE/OTHER BODIES: The Chief Auditor provides internal audit services to various associate bodies and the principles of this Audit Charter apply to those associate bodies by means of a service level agreement between the Council and the body: Associate Body Defined ‘Board’ Defined “Senior Management” Renfrewshire Valuation Joint Board Joint Board Assessor and Electoral Registration Officer Renfrewshire Leisure Ltd Board of Directors Chief Executive Scotland Excel Executive Sub- Committee Director Glasgow and Clyde Valley Strategic Development Planning Authority Joint Committee Strategic Development Plan Manager The Chief Auditor is the appointed internal auditor for the Renfrewshire Health and Social Care Integration Joint Board. Services are provided under the Internal Audit Charter for that Board. The Chief Auditor may provide internal audit services to other organisations, on a commercial basis, if this is in the interests of Renfrewshire Council. APPROVAL The Internal Audit Charter will be approved by the Board and shall be subject to regular review by the Chief Auditor in consultation with senior management. Effective date 22 May 2023