CIPFA Guidance complete
Renfrewshire Council · 6 November 2023
Back to Audit, Risk and Scrutiny Board — 6 November 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 06 November 2023 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: CIPFA Audit Committee Guidance – Self Assessment Arrangements ________________________________________________________ 1. Summary 1.1 The Chartered Institute of Public Finance and Accountancy (CIPFA) published guidance in late 2022 for local authority Audit Committees. The purpose of the guidance is to support Audit Committee members in fulfilling their role on the Audit Committee. 1.2 The guidance promotes that a regular self-assessment against the key principles should be undertaken, to support the planning of the audit committee work programme and training plans and also inform the annual report. 1.3 Where an audit committee has a high degree of performance against the good practice principles, it is an indicator that the committee is soundly based and has in place a knowledgeable membership. These are the essential factors in developing an effective audit committee. 1.4 This report seeks to provide members with an overview of the new CIPFA guidance and develop the arrangements for conducting a self-assessment of compliance against the guidance. ___________________________________________________________________ Recommendations 2.1 That the Audit, Risk and Scrutiny Board are asked to agree the proposed format for the self-assessment against the CIPFA Audit Committee Guidance.
Page 2
2.2 That the Audit, Risk and Scrutiny Board are asked to agree a suitable date for the member development session. 2.3 That the Audit, Risk and Scrutiny Board are asked to agree that the resulting action plan will be submitted to the Council, and completion of the plan will be monitored 6 monthly by the Audit, Risk and Scrutiny Board. ___________________________________________________________________ 3. Background Effective Audit Committees 3.1 The Audit Committee is a key part of an organisation’s governance arrangements and one of its key roles is ensuring that there is sufficient assurance over the governance risk and control framework. It can be a valuable resource for the whole organisation. 3.2 An audit committee’s effectiveness should be judged by the contribution it makes to and the beneficial impact it has on the authority’s business. Since it is primarily an advisory body, it can be more difficult to identify how the audit committee has made a difference. Evidence of effectiveness will usually be characterised as ‘influence’, ‘persuasion’ and ‘support’ 3.3 To develop the Audit Committee and provide assurance via the annual report, it is recommended that the committee is supported in a self-assessment. Alternatively, an independent review can be undertaken. 3.4 The CIPFA guidance provides a framework for assessing the effectiveness of the Audit Committee, this framework comprises distinct but inter-dependent areas that should be assessed. • Self-assessment of good practice (Appendix 1) This question set provides a high-level review that incorporates the key principles set out in CIPFA’s Position Statement and the revised Audit Committee Guidance. The framework covers the core functions and the administrative arrangements of the Audit Committee, with some areas being outwith the direct control of the Audit Committee members. It is proposed that an initial assessment is undertaken by the Chair of the Audit, Risk and Scrutiny Board, the Chief Auditor, the Clerk to the Board and any other officers from the Council contributing where appropriate. From the initial assessment any identified areas for further discussion and development will be incorporated into the development session detailed below. • Evaluating the impact and effectiveness of the audit committee (Appendix 2) The appendix provides a resource to support a self-assessment against these areas and to encourage reflection on the impact, influence and effectiveness of the committee. It is proposed that a development session
Page 3
is arranged, with participation from the members of the Audit, Risk and Scrutiny Board. The outcome of the development session will be a comprehensive action plan for improvement and compliance against the CIPFA guidance. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development – None 3. Community Planning – Safer and Stronger - None 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The report addresses the risk of non-compliance against the revised CIPFA guidance for an effective Audit Committee. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Andrea McMahon, Chief Auditor
Page 4
53 APPENDIX 1 Self-assessment of good practice This appendix provides a high-level review that incorporates the key principles set out in CIPFA’s Position Statement and this publication. Where an audit committee has a high degree of performance against the good practice principles, it is an indicator that the committee is soundly based and has in place a knowledgeable membership. These are the essential factors in developing an effective audit committee. A regular self-assessment should be used to support the planning of the audit committee work programme and training plans. It will also inform the annual report. 1 Good practice questions Does not comply Partially complies and extent of improvement needed* Fully complies Major improvement Significant improvement Moderate improvement Minor improvement No further improvement Weighting of answers 0 1 2 3 5 Audit committee purpose and governance 1 Does the authority have a dedicated audit committee that is not combined with other functions (eg standards, ethics, scrutiny)? 2 Does the audit committee report directly to the governing body (PCC and chief constable/full council/full fire authority, etc)? 3 Has the committee maintained its advisory role by not taking on any decision-making powers? 4 Do the terms of reference clearly set out the purpose of the committee in accordance with CIPFA’s 2022 Position Statement? 5 Do all those charged with governance and in leadership roles have a good understanding of the role and purpose of the committee? 6 Does the audit committee escalate issues and concerns promptly to those in governance and leadership roles? 7 Does the governing body hold the audit committee to account for its performance at least annually? * Where the committee does not fully comply with an element, three options are available to allow distinctions between aspects that require significant improvement and those only requiring minor changes.
Page 5
AUDIT COMMITTEES \ PRACTICAL GUIDANCE FOR LOCAL AUTHORITIES AND POLICE GUIDING THE AUDIT COMMITTEE 54 Good practice questions Does not comply Partially complies and extent of improvement needed Fully complies Major improvement Significant improvement Moderate improvement Minor improvement No further improvement Weighting of answers 0 1 2 3 5 8 Does the committee publish an annual report in accordance with the 2022 guidance, including: • compliance with the CIPFA Position Statement 2022 • results of the annual evaluation, development work undertaken and planned improvements • how it has fulfilled its terms of reference and the key issues escalated in the year? Functions of the committee 9 Do the committee’s terms of reference explicitly address all the core areas identified in CIPFA’s Position Statement as follows? Governance arrangements Risk management arrangements Internal control arrangements, including: • financial management • value for money • ethics and standards • counter fraud and corruption Annual governance statement Financial reporting Assurance framework Internal audit External audit 10 Over the last year, has adequate consideration been given to all core areas? 11 Over the last year, has the committee only considered agenda items that align with its core functions or selected wider functions, as set out in the 2022 guidance? 12 Has the committee met privately with the external auditors and head of internal audit in the last year?
Page 6
APPENDIx E \ SELF-ASSESSMENT OF GOOD PRACTICE 55 Good practice questions Does not comply Partially complies and extent of improvement needed Fully complies Major improvement Significant improvement Moderate improvement Minor improvement No further improvement Weighting of answers 0 1 2 3 5 Membership and support 13 Has the committee been established in accordance with the 2022 guidance as follows? • Separation from executive • A size that is not unwieldy and avoids use of substitutes • Inclusion of lay/co-opted independent members in accordance with legislation or CIPFA’s recommendation 14 Have all committee members been appointed or selected to ensure a committee membership that is knowledgeable and skilled? 15 Has an evaluation of knowledge, skills and the training needs of the chair and committee members been carried out within the last two years? 16 Have regular training and support arrangements been put in place covering the areas set out in the 2022 guidance? 17 Across the committee membership, is there a satisfactory level of knowledge, as set out in the 2022 guidance? 18 Is adequate secretariat and administrative support provided to the committee? 19 Does the committee have good working relations with key people and organisations, including external audit, internal audit and the CFO? Effectiveness of the committee 20 Has the committee obtained positive feedback on its performance from those interacting with the committee or relying on its work? 21 Are meetings well chaired, ensuring key agenda items are addressed with a focus on improvement? 22 Are meetings effective with a good level of discussion and engagement from all the members? 23 Has the committee maintained a non-political approach to discussions throughout?
Page 7
AUDIT COMMITTEES \ PRACTICAL GUIDANCE FOR LOCAL AUTHORITIES AND POLICE GUIDING THE AUDIT COMMITTEE 56 Good practice questions Does not comply Partially complies and extent of improvement needed Fully complies Major improvement Significant improvement Moderate improvement Minor improvement No further improvement Weighting of answers 0 1 2 3 5 24 Does the committee engage with a wide range of leaders and managers, including discussion of audit findings, risks and action plans with the responsible officers? 25 Does the committee make recommendations for the improvement of governance, risk and control arrangements? 26 Do audit committee recommendations have traction with those in leadership roles? 27 Has the committee evaluated whether and how it is adding value to the organisation? 28 Does the committee have an action plan to improve any areas of weakness? 29 Has this assessment been undertaken collaboratively with the audit committee members? Subtotal score Total score Maximum possible score 200** 2 ** 40 questions/sub-questions multiplied by five.
Page 8
57 APPENDIX 2 Evaluating the impact and effectiveness of the audit committee An audit committee’s effectiveness should be judged by the contribution it makes to and the beneficial impact it has on the authority’s business. Since it is primarily an advisory body, it can be more difficult to identify how the audit committee has made a difference. Evidence of effectiveness will usually be characterised as ‘influence’, ‘persuasion’ and ‘support’. The improvement tool below can be used to support a review of effectiveness. It identifies the broad areas where an effective audit committee will have impact. Figure 1: The influential audit committee THE INFLUENTIAL AUDIT COMMITTEE SUPPORTS: IMPROVING VALUE FOR MONEY EFFECTIVE RISK MANAGEMENT EFFECTIVE INTERNAL CONTROLS EMBEDDING ETHICAL VALUES AND COUNTERING FRAUD IMPROVING PUBLIC REPORTING, TRANSPARENCY AND ACCOUNTABILITY GOOD GOVERNANCE AND DECISION MAKING EFFECTIVE AUDIT AND ASSURANCE ACHIEVEMENT OF GOALS
Page 9
AUDIT COMMITTEES \ PRACTICAL GUIDANCE FOR LOCAL AUTHORITIES AND POLICE GUIDING THE AUDIT COMMITTEE 58 The table includes examples of what the audit committee might do to have impact in each of these areas. The third area includes key indicators that might be expected to be in place if arrangements are in fact effective. These indicators are not directly within the control of the audit committee, as it is an advisory body. They do provide an indication that the authority has put in place adequate and effective arrangements, which is the purpose of the committee. Use the tool for discussion and evaluation of the strengths and weakness of the committee, identifying areas for improvement. Areas where the audit committee can have impact by supporting improvement Examples of how the audit committee can demonstrate its impact Key indicators of effective arrangements Your evaluation: strengths, weaknesses and proposed actions Promoting the principles of good governance and their application to decision making. • Supporting the development of a local code of governance. • Providing a robust review of the AGS and the assurances underpinning it. • Supporting reviews/audits of governance arrangements. • Participating in self- assessments of governance arrangements. • Working with partner audit committees to review governance arrangements in partnerships. • Elected members, the leadership team and senior managers all share a good understanding of governance, including the key principles and local arrangements. • Local arrangements for governance have been clearly set out in an up-to-date local code. • The authority’s scrutiny arrangements are forward looking and constructive. • Appropriate governance arrangements established for all collaborations and arm’s-length arrangements. • The head of internal audit’s annual opinion on governance is satisfactory (or similar wording). Contributing to the development of an effective control environment. • Encouraging ownership of the internal control framework by appropriate managers. • Actively monitoring the implementation of recommendations from auditors. • Raising significant concerns over controls with appropriate senior managers. • The head of internal audit’s annual opinion over internal control is that arrangements are satisfactory. • Assessments against control frameworks such as CIPFA’s FM Code have been completed and a high level of compliance identified. • Control frameworks are in place and operating effectively for key control areas – for example, information security or procurement.
Page 10
APPENDIx F \ EVALUATING THE IMPACT AND EFFECTIVENESS OF THE AUDIT COMMITTEE 59 Areas where the audit committee can have impact by supporting improvement Examples of how the audit committee can demonstrate its impact Key indicators of effective arrangements Your evaluation: strengths, weaknesses and proposed actions Supporting the establishment of arrangements for the governance of risk and for effective arrangements to manage risks. • Reviewing risk management arrangements and their effectiveness, eg risk management maturity or benchmarking. • Monitoring improvements to risk management. • Reviewing accountability of risk owners for major/ strategic risks. • A robust process for managing risk is evidenced by independent assurance from internal audit or external review. Advising on the adequacy of the assurance framework and considering whether assurance is deployed efficiently and effectively. • Reviewing the adequacy of the leadership team’s assurance framework. • Specifying the committee’s assurance needs, identifying gaps or overlaps in assurance. • Seeking to streamline assurance gathering and reporting. • Reviewing the effectiveness of assurance providers, eg internal audit, risk management, external audit. • The authority’s leadership team have defined an appropriate framework of assurance, including core arrangements, major service areas and collaborations and external bodies. Supporting effective external audit, with a focus on high quality and timely audit work. • Reviewing and supporting external audit arrangements with focus on independence and quality. • Providing good engagement on external audit plans and reports. • Supporting the implementation of audit recommendations. • The quality of liaison between external audit and the authority is satisfactory. • The auditors deliver in accordance with their audit plan and any amendments are well explained. • An audit of high quality is delivered. Supporting the quality of the internal audit activity, in particular underpinning its organisational independence. • Reviewing the audit charter and functional reporting arrangements. • Assessing the effectiveness of internal audit arrangements, providing constructive challenge and supporting improvements. • Actively supporting the quality assurance and improvement programme of internal audit. • Internal audit that is in conformance with PSIAS and LGAN (as evidenced by the most recent external assessment and an annual self-assessment). • The head of internal audit and the organisation operate in accordance with the principles of the CIPFA Statement on the Role of the Head of Internal Audit (2019).
Page 11
AUDIT COMMITTEES \ PRACTICAL GUIDANCE FOR LOCAL AUTHORITIES AND POLICE GUIDING THE AUDIT COMMITTEE 60 Areas where the audit committee can have impact by supporting improvement Examples of how the audit committee can demonstrate its impact Key indicators of effective arrangements Your evaluation: strengths, weaknesses and proposed actions Aiding the achievement of the authority’s goals and objectives by helping to ensure appropriate governance, risk, control and assurance arrangements. • Reviewing how the governance arrangements support the achievement of sustainable outcomes. • Reviewing major projects and programmes to ensure that governance and assurance arrangements are in place. • Reviewing the effectiveness of performance management arrangements. • Inspection reports indicate that arrangements are appropriate to support the achievement of service objectives. • The authority’s arrangements to review and assess performance are satisfactory. Supporting the development of robust arrangements for ensuring value for money. • Ensuring that assurance on value-for-money arrangements is included in the assurances received by the audit committee. • Considering how performance in value for money is evaluated as part of the AGS. • Following up issues raised by external audit in their value-for-money work. • External audit’s assessments of arrangements to support best value are satisfactory. Helping the authority to implement the values of good governance, including effective arrangements for countering fraud and corruption risks. • Reviewing arrangements against the standards set out in the Code of Practice on Managing the Risk of Fraud and Corruption (CIPFA, 2014). • Reviewing fraud risks and the effectiveness of the organisation’s strategy to address those risks. • Assessing the effectiveness of ethical governance arrangements for both staff and governors. • Good ethical standards are maintained by both elected representatives and officers. This is evidenced by robust assurance over culture, ethics and counter fraud arrangements.
Page 12
APPENDIx F \ EVALUATING THE IMPACT AND EFFECTIVENESS OF THE AUDIT COMMITTEE 61 Areas where the audit committee can have impact by supporting improvement Examples of how the audit committee can demonstrate its impact Key indicators of effective arrangements Your evaluation: strengths, weaknesses and proposed actions Promoting effective public reporting to the authority’s stakeholders and local community and measures to improve transparency and accountability. • Working with key members/ the PCC and chief constable to improve their understanding of the AGS and their contribution to it. • Improving how the authority discharges its responsibilities for public reporting – for example, better targeting the audience and use of plain English. • Reviewing whether decision making through partnership organisations remains transparent and publicly accessible and encourages greater transparency. • Publishing an annual report from the committee. • The authority meets the statutory deadlines for financial reporting with accounts for audit of an appropriate quality. • The external auditor completed the audit of the financial statements with minimal adjustments and an unqualified opinion. • The authority has published its financial statements and AGS in accordance with statutory guidelines. • The AGS is underpinned by a robust evaluation and is an accurate assessment of the adequacy of governance arrangements. OVERALL QUESTIONS TO CONSIDER 1 Does the committee proactively seek assurance over the key indicators? 2 How proactive is the committee in responding to aspects of governance, risk, control and audit that need change or improvement? 3 Are recommendations from the committee taken seriously by those responsible for taking action? REPORTING RESULTS The outcome of the review can be used to inform the committee’s annual report.