Item 6 Appendix 1 - 2025-2026 Internal Audit Annual Strategy and Plan
West Dunbartonshire Council · 10 December 2025
Back to Audit Committee — 10 December 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
2025/26 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 1. Introduction 1.1 The Global Internal Audit Standards (UK Public Sector) set out the requirement for the Shared Service Manager – Audit & Fraud to prepare a risk-based audit plan to determine the priorities of the internal audit activity, consistent with the organisation’s goals. 1.2 The Shared Service Manager – Audit & Fraud must review and adjust the plan as necessary in response to changes in the organisation’s business, risks, operations and priorities. 1.3 The audit plan must incorporate or be linked to a strategic or high-level statement of how the Internal Audit Service will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities. 1.4 The strategy shall be reviewed on an annual basis as part of the audit planning process. 2. Internal Audit Objectives 2.1 The purpose of Internal Audit, as defined within Global Internal Audit Standards (UK Public Sector) is to ‘strengthen the organisation’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight’. 2.2 The primary aim of the internal audit service is to provide assurance services which requires the Chief Internal Auditor to provide an annual internal audit opinion based on an objective assessment of the framework of governance, risk management and control. 2.3 The internal audit service also provides advisory services, generally at the request of the organisation, with the aim of improving governance, risk management and control and contributing to the overall opinion. 2.4 The internal audit service supports the Chief Officer Resources in his role as West Dunbartonshire Council’s (the Council) Section 95 Officer. 3. Risk Assessment and Audit Planning 3.1 The internal audit approach to annual audit planning is risk-based and all areas which may be subject to audit review are contained within an Audit Universe which is subject to formal review, at least annually. 3.2 The risk scoring system is maintained on a real-time basis and is altered as circumstances change. Regular reviews of the risk scores allow Internal Audit to address the changing risk exposure of the organisation more effectively and ensure audit effort is focused on those areas identified as higher risk. Item 6 Appendix 1
Page 2
2025/26 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN Appendix 1 3.3 The Audit Universe is risk assessed each year to determine the Annual Audit Plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Each area within the Audit Universe is assessed for impact against a number of broad risk categories as follows: Strategy Risks associated with the setting and achievement of strategic objectives. Economy Risks associated with the economy in which the Council operates. Reputation Risks associated with threats to the Council’s name and standing in the sector. Customer Risks associated with customer relationships. Legal/Regulatory Risks associated with the requirement to comply with a wide range of statute. Financial Risks associated with financial loss or inefficiency. Technology Risks associated with application systems, their integrity, security and development. Management Information Risks associated with the provision of information for decision- making purposes. Human Resources Risks associated with people, e.g. recruitment, succession, development, motivation and morale etc. Operations Risks associated with the business operating process. Business Continuity/Resilience Risks associated with disaster scenarios which would threaten the continuing operation of the Council. Security Risks associated with security over customer and the Council’s assets. Stakeholder Risks associated with management of stakeholder expectations (e.g. Government or local communities) Fraud Risks associated with asset misappropriation, corruption and financial statement fraud. 3.4 Account has also been taken of the risks identified in the Council’s Risk Registers and risks identified by external scrutiny bodies through local scrutiny arrangements. 3.5 There will be regular ongoing discussion with External Audit to ensure respective audit plans are reviewed as circumstances change in order to minimise duplication of effort and maximise audit coverage for the Council. 4 Service Delivery 4.1 The provision of the internal audit service is through a directly employed in-house team. The Shared Service Manager – Audit & Fraud is provided through a shared management arrangement with Inverclyde Council. 4.2 In relation to the total staff days allocated to the 2025/2026 plan, a resource allocation spreadsheet is completed for each member of staff which is split between annual leave, public holidays, training days, general administration and operational plan days.
Page 3
2025/26 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN Appendix 1 The combined operational plan is 645 days which will be resourced as follows: Team Member Plan Days Lead Internal Auditor (0.5 FTE)* 55 Internal Auditor (1.0 FTE)* 32 Internal Auditor (0.5 FTE) 90 Audit Assistant 108 Corporate Fraud Officer 180 Corporate Fraud Officer 180 Total Plan Days 645 * The Lead Internal Auditor and Internal Auditor posts are currently vacant. Options are currently being progressed to fill these vacancies by 1 February 2026. The Shared Service Manager – Audit & Fraud does not directly carry out the assignments included in the annual audit plan but provides the quality review and delivery oversight of the overall plan. As such, no direct time is included within the plan. Where there are any resource issues which may impact on delivery of the plan, this will be reported to the Audit Committee at the earliest opportunity. 4.3 Given the range and complexity of areas to be reviewed it is important that suitable, qualified, experienced and trained individuals are appointed to internal audit positions. The Global Interrnal Audit Standards (UK Public Sector) requires that the Chief Internal Auditor must hold a professional qualification such as CMIIA (Chartered Internal Auditor), CCAB or equivalent and be suitably experienced. 4.4 Internal audit staff members identify training needs as part of an appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. All training undertaken is recorded in a personal training record for CPD purposes. 4.5 Internal audit staff members require to conform to the Code of Ethics of the professional body of which they are members and to the Code of Ethics included within the Global Interrnal Audit Standards (UK Public Sector). An annual declaration is undertaken by staff in relation to specific aspects of the Code. 4.6 Following each review, audit reports are issued in draft format to agree the accuracy of findings and agree risk mitigations. Copies of final audit reports are issued to the relevant Chief Officer and Service Manager responsible for implementing the agreed action plan. A copy of each final audit report is also provided to External Audit. 4.7 The overall opinion of each audit report feeds into the Internal Audit Annual Report and Assurance Statement which is presented to the Audit Committee and is used by the s95 Officer in the preparation of the Annual Governance Statement.
Page 4
2025/26 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN Appendix 1 5 Proposed Audit Coverage 2025-2026 5.1 The proposed audit coverage is set out in the table below. This includes a range of risk based reviews, limited scope financial reviews and regularity audits. 5.2 The Plan contains a contingency provision that will be utilised during the year in response to unforeseen work demands that arise e.g. special investigations and provision of ad hoc advice. Audit Area Strategic Area Risk Score Staff Days Risk-Based Reviews Budgetary Control (c/f 24/25) Corporate 7105 30 Care At Home - Delayed Discharge Arrangements HSCP 6800 25 Estates – Commercial and Industrial Property Rents and Leases Resources 6256 25 Total 80 Regularity Audits High Earners – Quarterly check Corporate N/A 20 Section Payments HSCP N/A 20 Education Control Self-Assessment Education N/A 20 Corporate Purchase Cards – Quarterly check Corporate N/A 20 Total 80 Corporate Governance Reviews Annual Governance Statement (2024/25) Corporate - 5 Total 5 Corporate Fraud Activity National Fraud Initiative Corporate - 150 Fraud Referrals including Joint Working - - 100 Whistleblowing and Other Investigations - - 90 Liaison with DWP - - 10 Fraud Awareness Training Corporate - 10 Total 360 Other Work Audit follow up Corporate - 10 IJB – Internal Audit Service - - 20 VJB – Internal Audit Service - - 15 Leisure Trust – Internal Audit Service - - 15 Contingency - - 10 Completion of 2024-2025 Audit Plan - - 50 Total 120 Total Staff Days for 2025/26 645
Page 5
2025/26 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN Appendix 1 6 Quality and Performance 6.1 The Global Interrnal Audit Standards (UK Public Sector) require each internal audit service to maintain an ongoing quality assurance and improvement programme based on an annual self-assessment against the Standards, supplemented at least every five years by a full independent external assessment. 6.2 In addition, the performance of Internal Audit continues to be measured against key service targets focussing on quality, efficiency and effectiveness. For 2025/2026 these have been set as follows: Measure Description Target 1. Draft Report Percentage of draft reports issued within 3 weeks of completion of fieldwork. 90% 2. Final Report Percentage of final reports issued within 2 weeks of issue of draft report. 90% 3. Audit Plan Delivery Percentage of audits completed v planned. 85% 4. Audit Budget Percentage of audits completed within budgeted days. 80% 5. Audit Recommendations Percentage of audit recommendations agreed. 90% 6. Action Plan Follow Up Percentage of action plans followed up – Internal and External Audit. 100% 7. Customer Feedback Percentage of respondents who rated the overall quality of internal audit as satisfactory or above. 100% 8. NFI recommended matches Percentage of National Fraud Initiative high risk matches investigated within timescales. 100% 9. DWP liaison Percentage of cases referred to/ actioned for DWP within DWP timescales. 100% 10. Staff compliance with CPD Number of training hours undertaken to support CPD 80 11. Management engagement Number of meetings with CMT and senior management as appropriate 1 per quarter 6.3 Actual performance against targets will be included in the 2025/26 Internal Audit Annual Assurance Report.
Page 6
No embedded text on this page.