Internal Audit Strategy 2025-28 and Audit Plan 2025-26
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT STRATEGY 2025-28 AND AUDIT PLAN 2025-26 1. INTRODUCTION 1.1 This report introduces the new Internal Audit Strategy covering 2025–28 and the Internal Audit Plan 2025-26. 2. RECOMMENDATIONS 2.1 To agree and endorse the Internal Audit Strategy 2025-28 (Appendix 1). 2.2 To agree and endorse the Internal Audit Plan 2025-26 (Appendix 2). 3. DETAIL 3.1 The Global Internal Audit Standards (GIAS), specifically Standard 9.2 ‘Internal Audit Strategy’ stipulates that the Chief Internal Auditor (CIA) must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation. A new Internal Audit Strategy has been developed which aligns the key priorities, objectives and strategic risks faced by the Council into the work of the internal audit function over the next three years. This helps to provide strategic direction to the internal audit function and support the Council in its approach to delivering its key objectives and allocates internal audit resources appropriately. Whilst the Strategy provides a good overview over the next three years, there are options to make adjustments where that is required or where new risks and alternative needs require to be accommodated. The key elements of the strategy include: • Audit Environment • Strategic Objectives • Delivering the Strategy • Delivering our Plans 3.2 The strategy further allows clear overview of how each of the three years link into providing the basis of each operational plan over the same period. The Audit Strategy for 2025 – 2028 is shown in Appendix 1. 3.3 The GIAS, specifically Standard 9.4 Internal Audit Plan further requires that the Council has an internal audit plan which must be risk based and focused on governance, risk and controls to allow the Chief Internal Auditor (CIA) to provide an annual opinion on the Council’s internal control framework, based on the work undertaken during the year. This annual opinion informs the Annual Governance Statement. 3.4 The Annual Audit Plan is shown at Appendix 2. The creation of the plan gave consideration to a number of factors including:
Page 2
• the audit universe risk assessment which is based upon a matrix taking account of scores for each potential audit area in respect of materiality, sensitivity, time elapsed since it was last subject to audit and the overall audit assessment when it was last reviewed • the Council’s strategic risk register and operational risk registers • input from Executive Directors, the Health and Social Care Partnership (HSCP) Chief Officer, Heads of Service and Audit and Scrutiny Committee members • a consideration of the need to provide audit coverage across all Heads of Service, the HSCP and LiveArgyll • significant changes within the Council (i.e. new systems, new policies) • wider issues in the public sector environment • an internal audit team meeting to discuss possible areas of focus based on cumulative audit knowledge • Culture, technological governance, controls in operation and fraud risk 3.5 The Audit plan is broken down into 3 main areas which are: • Service department reviews • Continuous monitoring programme • Other Activity 3.6 Service department reviews include auditable units within the audit universe which are specific to an individual department. Our continuous monitoring programme includes a number of auditable units which were historically subject to individual annual audits. These areas are now tested on a regular recurring basis with control weaknesses reported by exception. Internal Audit also undertake other activities during the year including verification work and following up on previous internal audit recommendations for improvement. 3.7 An indicative outline scope is given for each of the audit reviews. Full terms of reference will be discussed and agreed with the relevant Head of Service as part of the planning process for each audit. 3.8 The plan is based on an estimated available 658 audit days with suitable contingency factored in. The plan remains fully flexible, to accommodate changes in the Council’s risk profile and /or emerging risks. 3.9 Feedback on the draft plan has been obtained from the Heads of Service, the Chief Officer of the HSCP and the Live Argyll General Manager. This has been incorporated into the plan included as appendix 2 to this paper 4. CONCLUSION 4.1 The annual audit plan is risk based and is aligned to the Council’s long-term outcomes, corporate objectives and strategic risk register. The plan also incorporates continuous monitoring and verification activity. 5. IMPLICATIONS 5.1 Policy - None 5.2 Financial - None
Page 3
5.3 Legal - None 5.4 HR - None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change - None 5.7 Risk – Delivery of an effective internal audit function and plan should help reduce the Council’s risk exposure 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) - None Paul Macaskill, Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor (01436 604108) APPENDICES Appendix 1 – Internal Audit Strategy 2025-28 Appendix 2 – Internal Audit Plan 2025-26