Internal audit Charter March 2025
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Bute • Helensburgh • Islay • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Sel … INTERNAL AUDIT CHARTER April 2025
Page 2
2 Contents Introduction .................................................................................................................................................. 4 Purpose Statement of Internal Auditing– Domain I ............................................................................... 5 Definition of Internal Auditing (Glossary – Domain I) ........................................................................ 6 Commitment to Adhering to the Global Internal Audit Standards ................................................... 6 Mandate ................................................................................................................................................... 6 Authority, Reporting Relationships and Positioning ...................................................................... 6 Ethics & Professionalism– Domain II ...................................................................................................... 7 Demonstrate Integrity ............................................................................................................................ 7 Maintain Objectivity ................................................................................................................................ 8 Demonstrate Competency .................................................................................................................... 9 Exercise Due Professional Care .......................................................................................................... 9 Maintain Confidentiality ....................................................................................................................... 10 Governing the Internal Audit Function & Audit and Scrutiny Committee Oversight – Domain III (Included specifics from approved Uk public sector document approved ....................................... 10 Mandate ................................................................................................................................................. 11 Authority ............................................................................................................................................. 11 Changes to the Mandate and Charter ........................................................................................... 11 Positioned Independently – The Boad establishes and protects the internal audit function’s independence and qualifications........................................................................................................ 11 Overseen by the Board (Audit and Scrutiny Committee) – The Board oversees the internal audit function to ensure the functions effectiveness. ...................................................................... 12 Managing the Internal Audit Function – Domain IV ............................................................................ 13 Plan Strategically .................................................................................................................................. 13 Manage Resources .............................................................................................................................. 13 Communicate effectively ..................................................................................................................... 14 Communication with the Audit and Scrutiny Committee and Senior Management within the Council ............................................................................................................................................... 14 Enhance quality .................................................................................................................................... 15 Quality Assurance and Improvement Program with the Council for Internal Audit ................ 15 Performing Internal Audit Services - – Domain V ................................................................................ 16 Plan Engagement Effectively & Conduct Engagement Work ........................................................ 16 Communicate Engagement Conclusion & Monitoring Action Plans ............................................. 18 Fraud and Corruption ........................................................................................................................... 18
Page 3
3 Glossary Board - refers to the Council’s Audit and Scrutiny Committee (the Committee) which has delegated responsibility for overseeing the work of Internal Audit Senior Management - is defined as the Chief Executive and members of the Council’s Strategic Management Team (SMT) Chief Audit Executive - refers to the Chief Internal Auditor (CIA) Links 1. GIAS - IIA 2. Code of Practice for the Governance of Internal Audit in Local Government - CiPFA 3. GlAS in the UK Public Sector - CiPFA Document Version Control 1. Comprehensive review and update to take reflect the new Global Internal Audit Standards – Effective from 1st April 2025
Page 4
4 Internal Audit Charter for Argyll and Bute Council Introduction 1. The Local Authority Accounts (Scotland) Regulations 2014 introduced a statutory requirement for all Scottish Local Authorities to have in place and to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Global Internal Audit Standards (GIAS). The GIAS, in the applicability to the public sector, must be considered along with the Application Note: Global Internal Audit Standards in the UK Public Sector which have been produced to assist with the interpretation of the GIAS. 2. The GIAS contain requirements to support 15 guiding principles associated with and expected to be operating within the Internal Audit function across 5 key domains, Purpose, Ethics and Professionalism, Governing, Managing and Performing, these domains and the 15 guiding principles are outlined in the images below.
Page 5
5 3. The GIAS require Argyll and Bute Council (Council) to have an Internal Audit Charter (the Charter), which must be consistent with the ‘purpose statement’ which is intended to assist internal auditors and internal audit stakeholders in understanding and articulating the value of internal auditing. Purpose Statement of Internal Auditing– Domain I 4. The purpose of the internal audit function is to strengthen Argyll and Bute Council’s ability to create, protect, and sustain value by providing the Council and management with independent, risk-based, and objective assurance, advice, insight, and foresight. 5. The internal audit function enhances the Council’s: • Successful achievement of its objectives. • Governance, risk management, and control processes. • Decision-making and oversight. • Reputation and credibility with its stakeholders. • Ability to serve the public interest. • Anti-fraud and corruption arrangements. • Section 95 Officer and Monitoring Officer roles.
Page 6
6 Definition of Internal Auditing (Glossary – Domain I) 6. An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. 7. Argyll and Bute Council’s internal audit function is most effective when: • Internal auditing is performed by competent professionals in conformance with the IIA’s Global Internal Audit Standards, which are set in the public interest. • The internal audit function is independently positioned with direct accountability to the Senior Management and the Audit and Scrutiny Committee. • Internal auditors are free from undue influence and committed to making objective assessments. Commitment to Adhering to the Global Internal Audit Standards 8. Argyll and Bute Council’s internal audit function will adhere to the GIAS and Topical Requirements. The Chief Audit Executive (Chief Internal Auditor within Argyll and Bute Council) will report annually to the Audit and Scrutiny Committee and senior management regarding the internal audit function’s conformance with the GIAS, which will be assessed through a quality assurance and improvement program. Mandate Authority, Reporting Relationships and Positioning 9. Argyll and Bute Council’s internal audit function mandate is found in the Council Constitution and in particular, Appendix 1 to the Financial and Security Regulations. 10. The internal audit function’s authority is created by its direct reporting relationship to senior management and the Audit and Scrutiny Committee. Such authority allows for unrestricted access to the Chair and Vice-Chair of the Audit and Scrutiny Committee. 11. Internal audit, with strict accountability for confidentiality and safeguarding records and information, has authorised full, free, and unrestricted access to any and all of the Council’s records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist Internal Audit in fulfilling its roles and responsibilities. Internal Audit, through the CIA, will also have free and unrestricted access to the Committee. The Council authorises the internal audit function, without necessarily giving prior notice, to require and receive:
Page 7
7 • access to all records, documents and correspondence relating to any financial or other relevant transactions, including documents of a confidential nature. • access at all reasonable times to any land, premises, officers and members of the Council. • the production of any cash, stores or other property of the Council under an officer’s and member’s control. • explanations concerning any matter under investigation. Ethics & Professionalism– Domain II Demonstrate Integrity 12. The CIA will ensure that internal auditors: • Conform with the GIAS, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the organisation. • Report organisational behaviour that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures. 13. The GIAS generally and GIAS 1.2 (Organisation’s Ethical Expectations) specifically describe the importance of internal auditors encouraging and promoting an ethics-based culture alongside personal adherence to the ethical expectations of their organisation. This need for ethical behaviour is especially relevant in the UK public sector where those delivering public services are both servants of the public and stewards of public resources. To this end all staff within the Council’s Internal audit function will adhere to the GIAS and have due regard to the need to make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments, as detailed in the 7 Principles of Public Life (the ‘Nolan principles’) 14. Internal Audit will adhere to the GIAS, which update and replace the former mandatory guidance including the Definition of Internal Auditing, the Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing. The GIAS provides fundamental requirements for the professional practice of Internal Auditing and for evaluating the effectiveness of the Internal Audit’s performance 15. Each member of the Internal Audit team completes a register of interest and updates it, at a minimum, on an annual basis. 16. Internal auditors must exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined, as detailed in the GIAS.
Page 8
8 Maintain Objectivity 17. The CIA will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CIA determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. 18. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance. 19. Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for Argyll and Bute Council or its affiliates. • Initiating or approving transactions external to the internal audit function. • Directing the activities of any Argyll and Bute Council employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors. Internal auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to appropriate parties and at least annually, such as the CIA, Audit and Scrutiny committee, management, or others. • Exhibit professional objectivity in gathering, evaluating, and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. 20. The Chief Internal Auditor (CIA) will be positioned at a level in the organisation that enables internal audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the internal audit function. (See “Mandate” section.) The CIA will report to the Audit and Scrutiny Committee and to the Executive Director with responsibility as the Section 95 Officer of the Council and, in their absence to the Chief Executive. The CIA will also report to the Head of Financial Services for administrative purposes. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity.
Page 9
9 21. The CIA will confirm to the Audit and Scrutiny Committee, at least annually, the organisational independence of the internal audit function. If the governance structure does not support organisational independence, the CIA will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. 22. The CIA will disclose to the Audit and Scrutiny Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfil its mandate Demonstrate Competency 23. The Chief Audit Executive will hold an appropriate professional qualification along side relevant experience. Therefore, in considering whether a Chief Audit Executive is suitably qualified, an organisation must be looking for: • CMIIA, or a CCAB qualification, or an equivalent professional qualification which includes training on the practice of internal audit, and • suitable internal audit experience 24. In addition, all staff who are on professional training programs must comply with their terms and conditions of practice and maintain the standards expected of the professional institute they belong to and other relevant requirements as outlined in this Charter. 25. All staff must maintain their continued professional development in accordance with their professional body on an annual basis and make the appropriate declaration where required. Exercise Due Professional Care 26. In completing planning activities and subsequent audit work internal auditors shall consider the: • extent of work needed to achieve the engagement’s objectives. • relative complexity, materiality or significance of matters to which assurance procedures are applied. • adequacy and effectiveness of governance, risk management and control processes • probability of significant errors, fraud, or non-compliance. • cost of assurance in relation to potential benefits. 27. In addition, internal auditors exercise due professional care during a consulting engagement by considering the:
Page 10
10 • needs and expectations of clients, including the nature, timing and communication of engagement results • relative complexity and extent of work needed to achieve the engagement’s objectives • cost of the consulting engagement in relation to potential benefits. 28. The CIA will ensure that regular conversations take place about performance, behaviours and career/development aspirations in line with the Council’s -approach to the annual appraisal process, this will be undertaken on a yearly basis. Maintain Confidentiality 29. The GIAS set out the duty on internal auditors to be faithful custodians of the information they gather, sharing only in limited, defined and controlled ways. GIAS 5.2 (Protection of Information) describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. 30. While the duties under GIAS mainly relate to restricting the sharing of information, auditors working in the UK public sector must also be aware of circumstances under which sharing or publication of information will be required. They must be aware of their organisation’s policies and procedures for routine publication of certain information and where there are statutory obligations to share or publish information. 31. In Argyll and Bute Council, internal audit staff will be required to adhere to the GIAS but also the GDPR and Data Protection legislation, together with the requirements for document retention and disposal in accordance with Council policy and guidance. Governing the Internal Audit Function & Audit and Scrutiny Committee Oversight – Domain III (Included specifics from approved Uk public sector document approved 32. Appropriate governance arrangements are essential to enable the internal audit function to be effective. This domain outlines the requirements for the CIA to work closely with the Board to establish the internal audit function, position it independently and oversee its performance. 33. In the United Kingdom, such arrangements are highly developed, particularly within local government and is further supplemented by the CiPFA in the ‘Practical Guidance for Audit Committees for Local Authorities and Police 2022 edition’ which is used as the
Page 11
11 basis for the induction process of all members on the Audit and Scrutiny Committee and review of performance of the Committee on a periodic basis, where required. 34. Authorised by the Board (Audit and Scrutiny Committee) – the Board establishes, approves and supports the mandate of the internal audit function. Mandate Authority 35. This is defined under Domain I and can be viewed at paragraphs 9 – 11 above. Changes to the Mandate and Charter 36. Circumstances may justify a follow-up discussion between the CIA, Audit and Scrutiny Committee, and senior management on the internal audit mandate or other aspects of the internal audit charter. Such circumstances may include but are not limited to: • A significant change in the GIAS • A significant reorganisation within the Council • Significant changes in the CIA, Council, and/or senior management. • Significant changes to the organisation’s strategies, objectives, risk profile, or the environment in which the organisation operates • New laws or regulations that may affect the nature and/or scope of internal audit services. Positioned Independently – The Boad establishes and protects the internal audit function’s independence and qualifications 37. The Board is responsible for enabling the independence of the internal audit function. Independence is defined as the freedom from conditions that impair the internal audit function’s ability to carry out its responsibilities in an unbiased manner. 38. In Argyll and Bute Council, the CIA reports in his/her name to the Council’s Audit and Scrutiny Committee directly, is appropriately qualified and experienced and reports directly to the Section 95 Officer and has access to the Chief Executive and Monitoring Officer. This both maintains independence and positions the CIA within the organisation to discharge the function of internal audit and its responsibilities without interference. 39. The Board provides input to senior management on the CIA’s performance as required.
Page 12
12 Overseen by the Board (Audit and Scrutiny Committee) – The Board oversees the internal audit function to ensure the functions effectiveness. 40. Board oversight is essential to enable the overall effectiveness of the internal audit function. Achieving this principle requires collaboration and interactive communication between the Board and the CIA as well as the Board’s support in ensuring the internal audit function obtain sufficient resources to fulfil the internal audit mandate. 41. To establish, maintain, and ensure that Argyll and Bute Council’s internal audit function has sufficient authority to fulfil its duties, the Audit and Scrutiny Committee will: • Discuss with the CIA and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and/or advisory) of the internal audit function. • Ensure the CIA has unrestricted access to and communicates and interacts directly with the Audit and Scrutiny Committee, including in private meetings without senior management present, where that is required. • Discuss with the CIA and senior management other topics that should be included in the internal audit charter, where appropriate. • Participate in discussions with the CIA and senior management about the “essential conditions,” described in the GIAS, which establish the foundation that enables an effective internal audit function. • Approve the internal audit function’s charter, which includes the internal audit mandate and the scope and types of internal audit services. • Review the internal audit charter periodically with the CIA to consider changes affecting the organisation, such as the employment of a new CIA or changes in the type, severity, and interdependencies of risks to the organisation; and approve the internal audit charter on an annual basis. • Approve the risk-based internal audit plan and any strategy on which it is based and monitor completion of the plan, in accordance with any performance indicators set annually. • Through discussion with the CIA be satisfied that the internal audit function’s human resources, administration and budgets are sufficient to complete the Audit Plan and provide an annual opinion. • Through discussion with the CIA determine if he/she is satisfied that the service has appropriate levels of skills to fulfil its ability to complete the Audit Plan. • Ensure that the CIA has adequate competencies and qualifications in conformance with the GIAS. • Receive communications from the CIA about the internal audit function including its performance relative to its plan. These will be in accordance with the Committee’s scheduled timetabling of meetings as outlined in the Council’s meetings calendar. • Ensure a quality assurance and improvement program has been established and review the results annually and every five years for the external review to ensure that any deficiencies identified and opportunities for improvement contain an action plan and timeline for addressing these issues, together with monitoring progress.
Page 13
13 • Make appropriate inquiries of senior management and the CIA to determine whether scope or resource limitations are inappropriate. Managing the Internal Audit Function – Domain IV 42. The CIA is responsible for managing the internal audit function in compliance with the internal audit charter and GIAS. This responsibility includes strategic planning, obtaining and deploying resources, building relationships, communicating with stakeholders, and ensuring and enhancing the performance of the function. 43. The CIA is expected to conform with the GIAS, whilst the CIA may delegate appropriate responsibilities to other qualified professionals in the internal audit function, he/she retains ultimate accountability. Plan Strategically 44. Planning strategically requires the CIA to understand the internal audit mandate and organisational governance, risk management and control processes. A properly resourced and positioned internal audit function helps develop and implement a strategy to support the organisations success. 45. The CIA must develop and implement a strategy for the internal function that supports strategic objectives and success of the organisation and aligns with the expectations of the Board. An internal audit strategy must include a vision, strategic objectives and supporting initiatives for the internal audit function. 46. The CIA will develop and produce a three year Internal Audit Strategy to support the requirements of the GIAS and an annual operational plan will flow from the strategy in each of these three years. The strategy and resulting operational plan will be subject to ongoing monitoring, reviewed annually and updated where deemed appropriate. 47. The Council’s internal audit function will have appropriate supporting methodologies (processes and procedures) in place via the Internal Audit Manual to provide clear directions to staff on expected practices which must be followed to achieve the wider requirements within the GIAS and UK applications. Manage Resources 48. The CIA manages resources to implement the internal audit function’s strategy and achieve its plan and mandate. The CIA must develop a budget that enables the successful implementation of the plan, this will include training, technology and day-to- day activities.
Page 14
14 49. The Council has an established and documented process for the development of budgets and resources which will be needed to cover the work of the internal audit function. As part of the annual budget planning process the internal audit function will submit its needs which will include, but not limited to, staffing, technology, training, travel and other associated costs. 50. Appropriately qualified staff will be engaged to provide services within the internal audit function, together with appropriate training and continued professional development. Communicate effectively 51. The CIA guides the internal audit function to communicate effectively with its stakeholders, building relationships, establishing trust and enabling stakeholders to benefit from the results of the internal audit services. 52. The Council’s internal audit function has clear and documented processes for engagement with its stakeholders and are documented in its internal audit manual. This process includes but is not limited to, accurate, objective, clear, concise, constructive, complete and timely reporting of its fundings. 53. The Council’s internal audit function through the CIA, will inform the Board where there is inability to agree a recommendation with management, and where the function believes it is critical or high risk in relation to a control weakness which will put the Council at risk. In the event that other risks are identified which do not meet the threshold of being critical or high risk, acceptance of the risk will be noted in the action plan contained within the report. Communication with the Audit and Scrutiny Committee and Senior Management within the Council 54. The CIA will report periodically to the Audit and Scrutiny Committee and senior management regarding: • The internal audit function’s mandate. • The internal audit plan and performance relative to its plan. • Internal audit budget. • Significant revisions to the internal audit plan and budget. • Potential impairments to independence, including relevant disclosures as applicable. • Results from the quality assurance and improvement program, which include the internal audit function’s conformance with The IIA’s GIAS and action plans to address the internal audit function’s deficiencies, where identified and opportunities for improvement. • Significant risk exposures and control issues, including fraud risks, governance issues, and other areas of focus for the Audit and Scrutiny Committee, that could interfere with the achievement of Argyll and Bute Council’s strategic objectives. • Results of assurance services. • Resource requirements.
Page 15
15 • Management’s responses to risk that the internal audit function determines may be unacceptable or acceptance of a risk that is beyond Argyll and Bute Council’s risk appetite. Enhance quality 55. The CIA is responsible for the internal audit function’s conformance with the GIAS and continuous performance improvement where that is required. Appropriate and independent internal quality assessments will be required by self-assessment annually and externally every five years. Quality Assurance and Improvement Program with the Council for Internal Audit 56. The CIA will develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program will include external and internal assessments of the internal audit function’s conformance with the GIAS, as well as performance measurement to assess the internal audit function’s progress toward the achievement of its objectives and promotion of continuous improvement. The program also will assess, if applicable, compliance with laws and/or regulations relevant to internal auditing. Also, if applicable, the assessment will include plans to address the internal audit function’s deficiencies, where identified and opportunities for improvement. 57. Annually, the CIA will communicate with the Audit and Scrutiny Committee and senior management about the internal audit function’s quality assurance and improvement program, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside Argyll and Bute Council. 58. The Council participates as part of the Scottish Local Authority Chief Auditors Group who have a team of independent assessors who undertake the five year external assessments. All those involved in the independent external assessment must be both appropriately qualified and have suitable audit experience at a senior level. 59. In general and applicability to this Domain of the GIAS, the CIA has the responsibility to: • Develop a strategy and risk-based internal audit plan that considers the input of the Audit and Scrutiny Committee and senior management. Discuss the plan with the senior management and submit the plan to the Audit and Scrutiny Committee for review and approval. • Communicate the impact of resource limitations on the internal audit plan to the Audit and Scrutiny Committee and senior management. • Review and adjust the internal audit plan, as necessary, in response to changes in Argyll and Bute Council’s business, risks, operations, programs, systems, and controls.
Page 16
16 • Communicate with the Audit and Scrutiny Committee and senior management if there are significant interim changes to the internal audit plan. • Ensure internal audit engagements are performed, documented, and communicated in accordance with the GIAS and laws and/or regulations. • Follow up on engagement findings and confirm the implementation of recommendations or action plans and communicate the results of internal audit services to Argyll and Bute Council and senior management periodically and for each engagement as appropriate. • Ensure the internal audit function collectively possesses or obtains the knowledge, skills, and other competencies and qualifications needed to meet the requirements of the GIAS and fulfil the internal audit mandate. • Identify and consider trends and emerging issues that could impact Argyll and Bute Council and communicate to the Audit and Scrutiny Committee and senior management as appropriate. • Consider emerging trends and successful practices in internal auditing. • Establish and ensure adherence to methodologies designed to guide the internal audit function. • Ensure adherence to Argyll and Bute Council’s relevant policies and procedures unless such policies and procedures conflict with the internal audit charter or the GIAS and any supplementary UK application note. Any such conflicts will be resolved or documented and communicated to the Audit and Scrutiny Committee and senior management. • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the CIA cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary escalated to the Audit and Scrutiny Committee. Performing Internal Audit Services - – Domain V Plan Engagement Effectively & Conduct Engagement Work 60. The scope of internal audit services covers the entire breadth of the organisation, including all of Argyll and Bute Council’s activities, assets, and personnel. The internal audit function has an ‘Audit Universe’ which documents the breadth of services across the Council for this purpose. 61. The scope of internal audit activities also encompasses but is not limited to objective examinations of evidence to provide independent assurance and advisory services to the Audit and Scrutiny Committee and management on the adequacy and effectiveness of governance, risk management, and control processes for Argyll and Bute Council. 62. The CIA must consider the effect on the opinion work before accepting consultancy work or management requests over and above the contingency allowed for in the internal audit plan. Such consultancy work will only be undertaken where resources permit without impacting on the annual assurance process and where there is no direct or
Page 17
17 perceived conflict of interest or eroding of our independence and objectivity. Approval will be sought from the Audit and Scrutiny Committee before any significant unplanned consultancy work is accepted. 63. The nature, objectives and scope of advisory services may be agreed with the party requesting the service, provided the internal audit function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. 64. Internal audit engagements may include but are not limited to evaluating whether: • Risks relating to the achievement of Argyll and Bute Council’s strategic objectives are appropriately identified and managed. • The actions of Argyll and Bute Council’s officers, directors, management, employees, and contractors or other relevant parties comply with Argyll and Bute Council’s policies, procedures, and applicable laws, regulations, and governance standards. • The results of operations and work programs are consistent with established goals and objectives. • Operations and work programs are being carried out effectively, efficiently, ethically, and equitably. • Established processes and systems enable compliance with the policies, procedures, laws, and regulations that could significantly impact Argyll and Bute Council. • The integrity of information and the means used to identify, measure, analyse, classify, and report such information is reliable. • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately. 65. Where the Council works in partnership with other organisations, the role of internal audit will be defined on an individual basis. Where Internal Audit undertakes work on behalf of any other organisation, this will be determined in conjunction with the Committee and in consultation with the SMT to ensure that appropriate audit resources are available to provide assurance over the Council’s activities. Internal Audit currently provide audit services to LiveArgyll, the arrangements for internal audit have been agreed with LiveArgyll’s General Manager who reports to LiveArgyll’s Finance and Audit Sub-Committee. Since 1 April 2021 Internal Audit have been providing audit services to the Argyll and Bute Health and Social Care Partnership (HSCP). Arrangements for that service have been agreed with the HSCP’s Head of Finance and Transformation and report directly to the Audit and Risk Committee 66. The CIA co-ordinates and manages the Strategic Risk Register updates, however, there are certain safeguards whereby any audit review of this area requires to be undertaken, a senior qualified member of internal audit staff would complete the work and would report any serious direct findings to senior management.
Page 18
18 Communicate Engagement Conclusion & Monitoring Action Plans 67. Findings are communicated effectively, along with the significance and prioritisation, including limitations of scope, where appliable and conclusions in relation to governance, risk management and internal controls. The Council’s internal audit function will make all such communications in line with the GIAS and will be reflected in the Internal Audit Manual. 68. Appropriate follow up and monitoring of recommendations will be undertaken by the internal audit function and in the Council this will be reported to the Strategic Management Team (SMT) and the Audit and Scrutiny Committee. Fraud and Corruption 69. Managing the risk of fraud and corruption is the responsibility of the SMT. Management is also responsible for developing, implementing and maintaining systems of internal control to guard against fraud or irregularity and ensure probity in systems and operations. Internal Audit will assist management by reviewing the controls and procedures in place. 70. Audit procedures alone cannot guarantee that fraud and corruption will be detected, nor does Internal Audit have the responsibility for prevention and detection of fraud. However, individual auditors will be alert in their work to risks and exposures that could allow a fraud, irregularity or corrupt practice to take place. 71. Where any matter arises which involves, or is thought to involve, a fraud, corruption or irregularity, the relevant Head of Service / Executive Director will notify the Council’s Monitoring Officer, Head of Financial Services and the CIA for consideration of appropriate action. Further guidance can be found in the Council’s Anti-Fraud strategy and Public Interest Disclosure Policy. The Council’s Counter Fraud Team reports directly to the CIA so the CIA will be involved in overseeing any investigation and will liaise with the Council’s Monitoring Officer during the investigation of the alleged fraud and in particular: • examine current Council policies, procedures and financial controls, their current working and effectiveness in relation to the alleged fraud. • report to the SMT in relation to the adequacy of current Council policies, procedures and financial controls in relation to the alleged fraud and make recommendations for their revision. • provide advice and assistance to the Monitoring Officer in relation to Council policies, procedures and financial controls and other control issues relevant to the investigation of the alleged fraud.