Item 7 Appendix 1 - 2026-27 Internal Audit Planning
West Dunbartonshire Council · 10 June 2026
Back to Audit Committee — 10 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
West Dunbartonshire Council Internal Audit Planning 2026/27 ITEM 7 APPENDIX 1
Page 2
Internal Audit Planning 2026/27 Background The Annual Internal Audit Plan is prepared on an annual basis, detailing the work that the Council’s Internal Audit team plan to carry out in the year ahead. Planning the work is important to demonstrate that Internal Audit is proactive and that the activities are targeted to areas of risk and need. The Plan also must be flexible so that Internal Audit can react to events that might happen during the year. The Annual Internal Audit Plan is prepared by the Council’s Chief Internal Auditor and presented to the Audit Committee. Plan The plan for 2026/27 is specified to provide adequate evidence relating to the Council’s systems to enable the Council’s Chief Internal Auditor to provide a year-end opinion. This will be closely monitored and the Audit Committee will be kept informed of any change in the situation, with resources and expected outturn monitored as the year progresses. Planning Process The planning process begins with Internal Audit’s perspective included in a documented annual risk assessment. This is then compared to Senior Management’s expectations and assessment of risks. This includes not only our understanding of systems and controls but also the Council’s goals, external risks and current economic climate. The following alternative sources of assurance are also considered at the planning stage: external reports on the Council, the Council’s performance reports, reporting Risk Management, and where improvements are required. All auditors in the team have an accounting, risk management or internal audit qualification. When one of our stakeholders reads a Council Internal Audit Report they can be assured that is has been prepared with due recognition of the all the best practices, ethics and professional responsibilities, as is required. Having worked through all of the above, Internal Audit have a considerable amount of information and potential areas for review. Internal Audit cannot cover all areas of risk and we need to make sure what we plan to do is manageable and balanced against the abilities of the team. The Plan for 2026/27 includes a number of key areas of need to be reported on across the areas of Risk-based reviews, Regularity Audits and Other Work including for the Integrated Joint Board. The finalisation of the Plan will be delegated to the Chief Internal Auditor at the beginning of the 2026/27 financial year and further detail brought back to the Audit Committee. However, and consistent with prior years audit days will be assigned in the Plan to each assignment, based on an assessment of the relative risks of the audits planned and the expected complexities involved in undertaking the audit work. The work has been planned to enable us to draw conclusions on the Council as a whole. Future Reporting will determine the focus of the Internal Audit Team with the following principles continuing to apply:
Page 3
• The internal audit team will remain flexible and responsive to emerging risks and requests for assurance over new processes. This may lead to changes to the plan in the course of the year and ensures that the work remains risk focussed; and, • Service demands, audit resource availability, key officer availability and the skills mix of the individual members of the internal audit team will also be considered when scheduling audits. Key areas of Audit Focus Our ambitious plan of work continues to identify the following as key areas for review. These will be reviewed across the period to March 2027 subject to agreement with the Corporate Management Team and future reporting to the Audit Committee. • Key financial controls • Assets • Emerging areas of risk, for example new systems • Education Work will continue on the ‘in progress’ Budgetary Control and Procurement Compliance audits, carried forward from the 2025/26 audit plan into Q1 of 2026/27. Consideration has also been given as to how the Internal Audit plan aligns to the Council’s priorities. Audits will consider whether the controls in place are adequate to support the achievement of the system’s objectives. Although audits do not formally assess Best Value, the team seeks to identify ways in which processes can be improved and will highlight any areas where efficiencies can be achieved. Further detail on the audit plan will be brought back to the next committee meeting following the summer recess.
Page 4
Internal Audit Plan – Working to a Standard The Internal Audit Plan Planning for 2026/27 is based on a documented risk assessment process. The process uses the Council’s existing Risk Registers, the expectations of stakeholders, whilst considering the Council’s Strategic Plan and priorities. Planning takes into account the requirement to produce an annual audit opinion. This opinion is delivered through the statement on the adequacy and effectiveness of the Council’s framework of governance, risk management and internal controls. The statement is included within the ‘Internal Audit Annual Report’ presented to the first meeting of the Audit Committee following the end of the financial year and is used to inform the governance statement included in the annual accounts. Planning is linked to the Internal Audit Charter, ensuring that activities are consistent with existing direction, organisational objectives and priorities. The Internal Audit team also provides consultancy work on the basis that these assignments improve management of risks, add value and improve the Council’s operations. Provision for the completion of one consultancy note is included in the planned activities for the year. Audit Resources The Chief Internal Auditor plans to confirm that, in her opinion, their planned resources are appropriate and sufficient and will be effectively deployed to provide the required assurances to stakeholders. The provision of the internal audit service is through a directly employed in-house team. The Chief Internal Auditor is provided through a shared post arrangement with East Dunbartonshire and Inverclyde Councils. Planning is developed to ensure that staff availability, qualifications, experiences and skills are sufficient and appropriate. The process is supported by the Council’s ‘Be the Best Conversations’ framework, providing an ongoing mechanism to set personal objectives, development and training. In relation to the total staff days allocated to the 2026/2027 plan, a resource allocation spreadsheet is completed for each member of staff which is split between annual leave, public holidays, training days, general administration and operational plan days. The combined operational plan is 396 days which will be resourced as is shown in Table 1. Staff training and coaching are being used to good effect to aid in delivery of the Plan. In addition, the budgeted allocation for administrative time has been reviewed to ensure that the application of resources continues to be reasonable. The Chief Internal Auditor does not directly carry out the assignments included in the annual audit plan but provides the technical quality review and oversight of the delivery of the overall plan. Time is also set aside for overall audit planning, reporting on Internal Audit performance and attending Audit Committee. Where there are any resource issues which may impact on delivery of the plan, this will be reported to Audit Committee at the earliest opportunity. Given the range and complexity of areas to be reviewed it is important that suitable, qualified, experienced and trained individuals are appointed to internal audit positions. The Global Internal Audit Standards in the UK Public Sector (GIAS-UKPS) require that the Chief
Page 5
Internal Auditor must hold a professional qualification such as CMIIA (Chartered Internal Auditor), CCAB or equivalent and be suitably experienced. Internal audit staff members identify training needs as part of an appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. All training undertaken is recorded in a personal training record for CPD purposes. Internal audit staff members require to conform to the Code of Ethics of the professional body of which they are members and to the Code of Ethics included within the Global Internal Audit Standards. An annual declaration is undertaken by staff in relation to specific aspects of the Code. Following each review, audit reports are issued in draft format to agree the accuracy of findings and agree risk mitigations. Copies of final audit reports are issued to the relevant Chief Officer and Service Manager responsible for implementing the agreed action plan. A copy of each final audit report is also provided to External Audit. The overall opinion of each audit report feeds into the Internal Audit Annual Report and Assurance Statement which is presented to the Audit Committee and is used by the s95 Officer in the preparation of the Annual Governance Statement. Policies and Procedures The Internal Audit Manual serves as the Internal Audit Team’s policies and procedures. The Internal Audit Manual is aligned to the provisions of the Public Sector Internal Audit Standards and, in complying with the manual, the team is demonstrating compliance with the standards. The Public Sector Internal Audit Standards (PSIAS) were the previous applicable standards that the Internal Audit team conformed with. From 1 April 2025 GIAS- UKPS became the applicable standards. The Manual is reviewed on an ongoing basis with significant reviews taking place following changes in guidance, good practice or prevailing standards. A full review will be undertaken in 2026/27, to ensure full compliance with Global Internal Audit Standards in the UK Public Sector (GIAS-UKPS). Coordination with External Scrutiny Bodies The Chief internal Auditor is required to share information with other providers of assurance and consulting services to ensure proper coverage and minimise duplication of efforts. The External auditors, Forvis Mazars, audit plan for 2024/25 accounts includes a statement that they do not expect to use the work of the internal audit function for the purpose of their audit. Nonetheless, they will obtain the reports issued by internal audit relating to the financial period under audit to determine whether any findings will have an impact on our risk assessment and planned audit procedures. Reporting to Senior Management and the Board As part of this plan, the Chief Internal Auditor will prepare and present regular performance reports to the Audit Committee over the course of the financial year. The internal audit monitoring reports will review progress against the original plan in the interests of
Page 6
consistency and accountability. Performance reports will capture the activities of the Internal Audit Team relative to the original plan. Ongoing reporting will also highlight specific issues as they relate to risk exposures, control issues, fraud, governance or any other matters that the Chief Internal Auditor deems appropriate for consideration by the Committee. Significant issues will also be captured within the annual internal audit report. On an annual basis, the Chief Internal Auditor will provide a report that will include the purpose, authority and responsibilities relative to the plan but also any significant issues noted in the above. 2026/27 Audit Work The indicative planned number of days allocated to audit area is Table 1 and Table 2 provides a breakdown of the allocation of resources to Audit development. Internal Audit activity evaluates and contributes to the improvement of governance, risk management and control processes using a systematic and disciplined approach as outlined in the Internal Audit Charter. Planned audit work includes consideration of a number of different types of assignments including assurance audits, regularity and consultancy work. This varied application of audit resources ensures that different aspects of Council business have been subjected to testing, with assurances being sought over a range of activities. Overall Opinions Following the completion of the audit plan an overall opinion will be issued, taking into account the strategies, priorities and risks of the Council and the expectations of senior management, the Audit Committee and other stakeholders. The overall opinion must be supported by sufficient, reliable, relevant and useful information.
Page 7
Internal Audit Plan – Allocations and Activities TABLE 1 – Days Allocated by Audit Type Audit Type Days Audit 336 Regularity 30 Consultancy 30 Total 396 TABLE 2 – Days Allocated to Internal Audit Development Audit Development Days Training & Research 12 Supervision & Management of Staff 31 Administration 60 GIAS Review / Quality Assessment & Review 9 IA Performance Monitoring 18 Total 130
Page 8
No embedded text on this page.