Item 6 - Appendix 1
West Dunbartonshire Council · 3 May 2023
Back to Audit Committee — 3 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
2023/24 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 1. Introduction 1.1 The Public Sector Internal Audit Standards (PSIAS) set out the requirement for the Shared Service Manager – Audit & Fraud to prepare a risk-based audit plan to determine the priorities of the internal audit activity, consistent with the organisation’s goals. 1.2 The Shared Service Manager – Audit & Fraud must review and adjust the plan as necessary in response to changes in the organisation’s business, risks, operations and priorities. 1.3 The audit plan must incorporate or be linked to a strategic or high-level statement of how the Internal Audit Service will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities. 1.4 The strategy shall be reviewed on an annual basis as part of the audit planning process. 2. Internal Audit Objectives 2.1 The definition of internal auditing is contained within the PSIAS as follows: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 2.2 The primary aim of the internal audit service is to provide assurance services which requires the Chief Internal Auditor to provide an annual internal audit opinion based on an objective assessment of the framework of governance, risk management and control. 2.3 The internal audit service also provides advisory services, generally at the request of the organisation, with the aim of improving governance, risk management and control and contributing to the overall opinion. 2.4 The internal audit service supports the Chief Officer Resources in his role as West Dunbartonshire Council’s (the Council) Section 95 Officer. 3. Risk Assessment and Audit Planning 3.1 The internal audit approach to annual audit planning is risk-based and all areas which may be subject to audit review are contained within an Audit Universe which is subject to formal review, at least annually. 3.2 The risk scoring system is maintained on a real-time basis and is altered as circumstances change. Regular reviews of the risk scores allow Internal Audit to address the changing risk exposure of the organisation more effectively and ensure audit effort is focused on those areas identified as higher risk. Appendix 1
Page 2
2023/24 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 3.3 The Audit Universe is risk assessed each year to determine the Annual Audit Plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Each area within the Audit Universe is assessed for impact against a number of broad risk categories as follows: Strategy Risks associated with the setting and achievement of strategic objectives. Economy Risks associated with the economy in which the Council operates. Reputation Risks associated with threats to the Council’s name and standing in the sector. Customer Risks associated with customer relationships. Legal/Regulatory Risks associated with the requirement to comply with a wide range of statute. Financial Risks associated with financial loss or inefficiency. Technology Risks associated with application systems, their integrity, security and development. Management Information Risks associated with the provision of information for decision- making purposes. Human Resources Risks associated with people, e.g. recruitment, succession, development, motivation and morale etc. Operations Risks associated with the business operating process. Business Continuity/Resilience Risks associated with disaster scenarios which would threaten the continuing operation of the Council. Security Risks associated with security over customer and the Council’s assets. Stakeholder Risks associated with management of stakeholder expectations (e.g. Government or local communities) Fraud Risks associated with asset misappropriation, corruption and financial statement fraud. 3.4 Account has also been taken of the risks identified in the Council’s Risk Registers and risks identified by external scrutiny bodies through local scrutiny arrangements. 3.5 There will be regular ongoing discussion with External Audit to ensure respective audit plans are reviewed as circumstances change in order to minimise duplication of effort and maximise audit coverage for the Council. 4 Service Delivery 4.1 The provision of the internal audit service is through a directly employed in-house team. The Shared Service Manager – Audit & Fraud is provided through a shared service arrangement with Inverclyde Council. 4.2 In relation to the total staff days allocated to the 2023/2024 plan, a resource allocation spreadsheet is completed for each member of staff which is split between annual leave, public holidays, training days, general administration and operational plan days.
Page 3
2023/24 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN The combined operational plan is 800 days which will be resourced as follows: Team Member Plan Days Lead Auditor (0.5 FTE) 70 Auditor 50 Auditor (0.5 FTE) 90 Auditor (0.5 FTE) 90 Audit Assistant 108 Section Lead – Corporate Fraud 32 Corporate Fraud Officer 180 Corporate Fraud Officer 180 Total Plan Days 800 The Shared Service Manager – Audit & Fraud does not directly carry out the assignments included in the annual audit plan but provides the quality review and delivery oversight of the overall plan. As such, no direct time is included within the plan. The Section Lead – Corporate Fraud does not directly carry out NFI and other investigations but provides quality review and oversight of the work of the fraud officers and investigates any whistleblowing enquiries that may arise. As such, a small allocation of time is allocated to the plan. Where there are any resource issues which may impact on delivery of the plan, this will be reported to Audit Committee at the earliest opportunity. 4.3 Given the range and complexity of areas to be reviewed it is important that suitable, qualified, experienced and trained individuals are appointed to internal audit positions. The PSIAS requires that the Chief Internal Auditor must hold a professional qualification such as CMIIA (Chartered Internal Auditor), CCAB or equivalent and be suitably experienced. The internal auditor posts must also be CMIIA/CCAB or equivalent with previous audit experience. 4.4 Internal audit staff members identify training needs as part of an appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. All training undertaken is recorded in a personal training record for CPD purposes. 4.5 Internal audit staff members require to conform to the Code of Ethics of the professional body of which they are members and to the Code of Ethics included within the PSIAS. An annual declaration is undertaken by staff in relation to specific aspects of the Code. 4.6 Following each review, audit reports are issued in draft format to agree the accuracy of findings and agree risk mitigations. Copies of final audit reports are issued to the relevant Chief Officer and Service Manager responsible for implementing the agreed action plan. A copy of each final audit report is also provided to External Audit. 4.7 The overall opinion of each audit report feeds into the Internal Audit Annual Report and Assurance Statement which is presented to the Audit Committee and is used by the s95 Officer in the preparation of the Annual Governance Statement.
Page 4
2023/24 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 5 Proposed Audit Coverage 2023-2024 5.1 The proposed audit coverage is set out in the table below. This includes a range of risk based reviews, limited scope financial reviews and regularity audits. 5.2 The Plan contains a contingency provision that will be utilised during the year in response to unforeseen work demands that arise e.g. special investigations and provision of ad hoc advice. Audit Area Strategic Area Risk Score Staff Days Risk-Based Reviews Corporate Complaints Corporate 6344 30 Participatory Budgeting Corporate 5124 30 Attendance Management Corporate 4392 20 Commercial Waste Roads and Neighbourhood 4209 25 FM Cleaning – Stock Control CCF 4026 15 FM Catering – Stock Control CCF 4026 15 Corporate Procurement Corporate 4575 25 Total 160 Limited Scope Financial System Reviews Debt Recovery Resources 4600 20 Total 20 Project Assurance Reviews Learning Disability Services Review HSCP 7320 10 Total 10 Regularity Audits Education Control Self-Assessment Education N/A 15 High Earners – Quarterly check Corporate N/A 12 HSCP – Imprest HSCP N/A 14 Total 41 Advisory Reviews UK Shared Prosperity Fund Corporate 6222 20 Roads – Route Optimisation Roads and Neighbourhood 4392 10 Finance/HR Establishment Controls Corporate 3660 10 Total 40 Corporate Governance Reviews Annual Governance Statement (2022/23) Corporate - 5 Total 5 Corporate Fraud Activity National Fraud Initiative Corporate - 100 Fraud Referrals including Joint Working - - 250 Whistleblowing and Other Investigations - - 22 Liaison with DWP - - 10 Fraud Awareness Training Corporate - 10 Total 392 Other Work Audit follow up Corporate - 12 IJB – Internal Audit Service - - 20 VJB – Internal Audit Service - - 15 Leisure Trust – Internal Audit Service - - 15 Contingency - - 20 Completion of 2022-2023 Audit Plan - - 50 Total 132 Total Staff Days for 2023/24 800
Page 5
2023/24 INTERNAL AUDIT ANNUAL STRATEGY AND PLAN 6 Quality and Performance 6.1 The PSIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme based on an annual self-assessment against the Standards, supplemented at least every five years by a full independent external assessment. 6.2 In addition, the performance of Internal Audit continues to be measured against key service targets focussing on quality, efficiency and effectiveness. For 2023/2024 these have been set as follows: Measure Description Target 1. Draft Report Percentage of draft reports issued within 3 weeks of completion of fieldwork. 90% 2. Final Report Percentage of final reports issued within 2 weeks of issue of draft report. 90% 3. Audit Plan Delivery Percentage of audits completed v planned. 85% 4. Audit Budget Percentage of audits completed within budgeted days. 80% 5. Audit Recommendations Percentage of audit recommendations agreed. 90% 6. Action Plan Follow Up Percentage of action plans followed up – Internal and External Audit. 100% 7. Customer Feedback Percentage of respondents who rated the overall quality of internal audit as satisfactory or above. 100% 8. NFI recommended matches Percentage of National Fraud Initiative high risk matches investigated within timescales. 100% 9. DWP liaison Percentage of cases referred to/ actioned for DWP within DWP timescales. 100% 10. Staff compliance with CPD Number of training hours undertaken to support CPD 80 11. Management engagement Number of meetings with CMT and senior management as appropriate 1 per quarter 6.3 Actual performance against targets will be included in the 2023/24 Internal Audit Annual Assurance Report.