Item 9 - Appendix 1
West Dunbartonshire Council · 15 June 2022
Back to Audit Committee — 15 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
2022/23 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN Appendix 1 1. Introduction 1.1 The Public Sector Internal Audit Standards (PSIAS) set out the requirement for the Shared Service Manager – Audit & Fraud to prepare a risk-based audit plan to determine the priorities of the internal audit activity, consistent with the organisation’s goals. 1.2 The Shared Service Manager – Audit & Fraud must review and adjust the plan as necessary in response to changes in the organisation’s business, risks, operations and priorities. 1.3 The audit plan must incorporate or be linked to a strategic or high-level statement of how the Internal Audit Service will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities. 1.4 The strategy shall be reviewed on an annual basis as part of the audit planning process. 2. Internal Audit Objectives 2.1 The definition of internal auditing is contained within the PSIAS as follows: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 2.2 The primary aim of the internal audit service is to provide assurance services which requires the Chief Internal Auditor to provide an annual internal audit opinion based on an objective assessment of the framework of governance, risk management and control. 2.3 The internal audit service also provides advisory services, generally at the request of the organisation, with the aim of improving governance, risk management and control and contributing to the overall opinion. 2.4 The internal audit service supports the Chief Officer Resources in his role as West Dunbartonshire Council’s (the Council) Section 95 Officer. 3. Risk Assessment and Audit Planning 3.1 The internal audit approach to annual audit planning is risk-based and all areas which may be subject to audit review are contained within an Audit Universe which is subject to formal review, at least annually. 3.2 The risk scoring system is maintained on a real-time basis and is altered as circumstances change. Regular reviews of the risk scores allow Internal Audit to address the changing risk exposure of the organisation more effectively and ensure audit effort is focused on those areas identified as higher risk.
Page 2
2022/23 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 3.3 The Audit Universe is risk assessed each year to determine the Annual Audit Plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Each area within the Audit Universe is assessed for impact against a number of broad risk categories as follows: Strategy Risks associated with the setting and achievement of strategic objectives. Economy Risks associated with the economy in which the Council operates. Reputation Risks associated with threats to the Council’s name and standing in the sector. Customer Risks associated with customer relationships. Legal/Regulatory Risks associated with the requirement to comply with a wide range of statute. Financial Risks associated with financial loss or inefficiency. Technology Risks associated with application systems, their integrity, security and development. Management Information Risks associated with the provision of information for decision- making purposes. Human Resources Risks associated with people, e.g. recruitment, succession, development, motivation and morale etc. Operations Risks associated with the business operating process. Business Continuity/Resilience Risks associated with disaster scenarios which would threaten the continuing operation of the Council. Security Risks associated with security over customer and the Council’s assets. Stakeholder Risks associated with management of stakeholder expectations (e.g. Government or local communities) Fraud Risks associated with asset misappropriation, corruption and financial statement fraud. 3.4 Account has also been taken of the risks identified in the Council’s Risk Registers and risks identified by external scrutiny bodies through local scrutiny arrangements. 3.5 There will be regular ongoing discussion with External Audit to ensure respective audit plans are reviewed as circumstances change in order to minimise duplication of effort and maximise audit coverage for the Council. 4 Service Delivery 4.1 The provision of the internal audit service is through a directly employed in-house team. The Shared Service Manager – Audit & Fraud is provided through a shared service arrangement with Inverclyde Council. 4.2 In relation to the total staff days allocated to the 2022/2023 plan, each member of staff completes a resource allocation spreadsheet for the year which is split between annual leave, public holidays, training days, general administration and operational plan days. This spreadsheet is reviewed and updated each period by each member of staff against time charged to timesheets.
Page 3
2022/23 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN The combined operational plan is 1,160 days which will be resourced as follows: Team Member Plan Days Auditor 180 Lead Auditor (0.5 FTE) 70 Auditor (0.5 FTE) 90 Auditor (0.5 FTE) 90 Audit Assistant 160 Section Lead – Corporate Fraud 150 Corporate Fraud Officer 180 Corporate Fraud Officer (vacant)* 90 Intelligence Officer 150 Total Plan Days 1,160 * Due to the Covid-19 Pandemic, recruitment for the Corporate Fraud Officer post was delayed as home visits and interviews under caution were halted. It is anticipated we will start the recruitment process after the summer recess when those aspects of the team’s work are restarted, subject to relevant protocols being in place. The Shared Service Manager – Audit & Fraud does not directly carry out the assignments included in the annual audit plan but provides the quality review and delivery oversight of the overall plan. As such, no direct time is included within the plan. Where there are any resource issues which may impact on delivery of the plan, this will be reported to Audit Committee at the earliest opportunity. 4.3 Given the range and complexity of areas to be reviewed it is important that suitable, qualified, experienced and trained individuals are appointed to internal audit positions. The PSIAS requires that the Chief Internal Auditor must hold a professional qualification such as CMIIA (Chartered Internal Auditor), CCAB or equivalent and be suitably experienced. The internal auditor posts must also be CMIIA/CCAB or equivalent with previous audit experience. 4.4 Internal audit staff members identify training needs as part of an appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. All training undertaken is recorded in a personal training record for CPD purposes. 4.5 Internal audit staff members require to conform to the Code of Ethics of the professional body of which they are members and to the Code of Ethics included within the PSIAS. An annual declaration is undertaken by staff in relation to specific aspects of the Code. 4.6 Following each review, audit reports are issued in draft format to agree the accuracy of findings and agree risk mitigations. Copies of final audit reports are issued to the relevant Chief Officer and Service Manager responsible for implementing the agreed action plan. A copy of each final audit report is also provided to External Audit. 4.7 The overall opinion of each audit report feeds into the Internal Audit Annual Report and Assurance Statement which is presented to the Audit Committee and is used by the S95 Officer in the preparation of the Annual Governance Statement.
Page 4
2022/23 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 5 Proposed Audit Coverage 2022-2023 5.1 The proposed audit coverage is set out in the table below. This includes a range of risk based reviews, limited scope financial reviews and regularity audits. 5.2 The Plan contains a contingency provision that will be utilised during the year in response to unforeseen work demands that arise e.g. special investigations and provision of ad hoc advice. Audit Area Strategic Area Risk Score Staff Days Risk-Based Reviews Learning Disability Services – Financial Monitoring of Contracts (c/f) HSCP 9760 30 Fleet Management Corporate 8928 30 Occupational Therapy Waiting Times (c/f) HSCP 8184 30 Financial Assessment Process (c/f) HSCP 7936 30 Housing Repairs and Maintenance Supply, Distribution and Property 6882 30 Corporate Procurement – Supplier Management (c/f) Corporate 5952 30 Vehicle Maintenance Roads and Neighbourhood 5766 25 Void Management Supply, Distribution and Property 5616 30 Housing Waiting Lists Housing 4836 20 Parent Pay Education, Learning and Attainment 4650 25 Off Payroll Working (IR35) Corporate 4440 20 Corporate Purchase Cards Corporate 4428 30 Total 330 Limited Scope Financial System Reviews Non Domestic Rates Resources 4662 20 Creditors Resources 4350 20 Total 40 Compliance Reviews Health and Wellbeing Policy Corporate N/A 20 Total 20 Corporate Governance Reviews Annual Governance Statement (2021/2022) Corporate - 10 Total 10 Other Work Audit follow up Corporate - 20 HR/Payroll Verification Checks Corporate - 15 National Fraud Initiative Corporate - 100 Fraud Referrals including Joint Working Corporate - 425 Liaison with DWP - - 10 Fraud Awareness Training Corporate - 15 IJB – Internal Audit Service - - 40 VJB – Internal Audit Service - - 15 Leisure Trust – Internal Audit Service - - 10 Contingency - - 30 Completion of 2021-2022 Audit Plan - - 80 Total 760 Total Staff Days for 2022/23 1160
Page 5
2022/23 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 6 Quality and Performance 6.1 The PSIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme based on an annual self-assessment against the Standards, supplemented at least every five years by a full independent external assessment. 6.2 In addition, the performance of Internal Audit continues to be measured against key service targets focussing on quality, efficiency and effectiveness. For 2021/2022 these have been set as follows: Measure Description Target 1. Draft Report Percentage of draft reports issued within 3 weeks of completion of fieldwork. 90% 2. Draft Report Percentage of draft reports issued within 3 weeks of completion of fieldwork. 90% 3. Audit Plan Delivery Percentage of audits completed v planned. 85% 4. Audit Budget Percentage of audits completed within budgeted days. 80% 5. Audit Recommendations Percentage of audit recommendations agreed. 90% 6. Action Plan Follow Up Percentage of action plans followed up – Internal and External Audit. 100% 7. Customer Feedback Percentage of respondents who rated the overall quality of internal audit as satisfactory or above. 100% 8. NFI recommended matches Percentage of National Fraud Initiative high risk matches investigated within timescales. 100% 9. NFI other matches Percentage of National Fraud Initiative other matches investigated within timescales. 90% 10. DWP liaison Percentage of cases referred to/ actioned for DWP within DWP timescales. 100% 11. Staff compliance with CPD Number of training hours undertaken to support CPD 100 12. Management engagement Number of meetings with CMT and senior management as appropriate 1 per quarter 6.3 Actual performance against targets will be included in the 2022/23 Internal Audit Annual Assurance Report.