Internal Audit Manual March 2025
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Bute • Helensburgh • Islay • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Sel … INTERNAL AUDIT MANUAL April 2025
Page 2
Contents Introduction .................................................................................................................................................. 5 Purpose of Internal Audit – Domain I .......................................................................................................... 6 Definition of Internal Auditing (Glossary) ................................................................................................. 6 Purpose Statement .................................................................................................................................... 6 Internal Audit Mandate and Authority ...................................................................................................... 6 Ethics and Professionalism – Domain II ....................................................................................................... 7 Principle 1 – Demonstrate Integrity .......................................................................................................... 7 Honesty and Professional Courage – Standard 1.1 ............................................................................... 8 Organisational Ethical Expectations – Standard 1.2 .............................................................................. 8 Legal and Ethical Behaviour – Standard 1.3 .......................................................................................... 8 Principle 2 – Maintain Objectivity ............................................................................................................. 9 Individual Objectivity – Standard 2.1 .................................................................................................... 9 Safeguarding Objectivity – Standard 2.2 ............................................................................................... 9 Disclosing Impairments to Objectivity – Standard 2.3 ........................................................................ 10 Principle 3 – Demonstrate Competency.................................................................................................. 11 Competency – Standard 3.1 ................................................................................................................ 11 Continuing Professional Development – Standard 3.2 ....................................................................... 11 Principle 4 – Exercise Due Professional Care........................................................................................... 12 Conformance with the Global Internal Audit Standards – Standard 4.1............................................. 13 Due Professional Care – Standard 4.2 ................................................................................................. 13 Professional Scepticism – Standard 4.3 ............................................................................................... 13 Principle 5 – Maintain Confidentiality ..................................................................................................... 14 Use of Information – Standard 5.1 ...................................................................................................... 15 Protection of Information – Standard 5.2 ........................................................................................... 15 Governing the Internal Audit Function – Domain III ................................................................................. 16 Principle 6 – Authorised by the Board ..................................................................................................... 16 Internal Audit Mandate – Standard 6.1 ............................................................................................... 16 Internal Audit Charter – Standard 6.2 ................................................................................................. 16 Board and Senior Management Support – Standard 6.3 .................................................................... 17 Principle 7 – Positioned Independently................................................................................................... 17 Organisational Independence – Standard 7.1 ..................................................................................... 17 Chief Audit Executive (CIA) Qualifications – Standard 7.2 .................................................................. 18 Principle 8 – Overseen by the Board ....................................................................................................... 18
Page 3
3 Board Interaction – Standard 8.1 ........................................................................................................ 19 Resources – Standard 8.2 .................................................................................................................... 20 Quality – Standard 8.3 ......................................................................................................................... 20 External Quality Assessment – Standard 8.4 ....................................................................................... 20 Managing the Internal Audit Function – Domain IV .................................................................................. 21 Principle 9 – Plan Strategically ................................................................................................................ 21 Understanding Governance, Risk Management and Control Processes – Standard 9.1 .................... 21 Internal Audit Strategy - Standard 9.2 ................................................................................................. 22 Methodologies - Standard 9.3 ............................................................................................................. 23 Internal Audit Plan - Standard 9.4 ....................................................................................................... 23 Coordination and Reliance - Standard 9.5 ........................................................................................... 24 Principle 10 – Managing Resources ......................................................................................................... 24 Financial Resource Management - Standard 10.1 .............................................................................. 24 Human Resource Management - Standard 10.2 ................................................................................. 25 Technological Resources - Standard 10.3 ............................................................................................ 26 Principle 11 – Communicate Effectively .................................................................................................. 27 Building Relationships and Communicating with stakeholders - Standard 11.1 ................................. 27 Effective Communication - Standard 11.2 ........................................................................................... 27 Communicating Results - Standard 11.3 ............................................................................................. 28 Errors and Omissions - Standard 11.4 ................................................................................................. 29 Communicating the Acceptance of Risk - Standard 11.5 .................................................................... 29 Principle 12 – Enhance Quality ................................................................................................................ 30 Internal Quality Assessment - Standard 12.1 ...................................................................................... 30 Performance Measurement - Standard 12.2 ...................................................................................... 31 Oversee and Improve engagement Performance - Standard 12.3 ..................................................... 31 Performing Internal Audit Services – Domain V ........................................................................................ 32 Principle 13 – Plan Engagements Effectively ........................................................................................... 32 Engagement Communication - Standard 13.1 .................................................................................... 33 Engagement Risk Assessment - Standard 13.2 .................................................................................... 34 Engagement Objectives and Scope - Standard 13.3 ............................................................................ 35 Evaluation Criteria - Standard 13.4 ..................................................................................................... 36 Engagement Resources - Standard 13.5 .............................................................................................. 36 Work Program - Standard 13.6 ............................................................................................................ 37 Principle 14 – Conduct Engagement Work .............................................................................................. 37 Gathering Information for Analyses and Evaluation - Standard 14.1 ................................................. 38
Page 4
4 Analyses and Potential Engagement Findings - Standard 14.2 ........................................................... 38 Evaluation of Findings - Standard 14.3 ................................................................................................ 39 Recommendations and Action Plans - Standard 14.4 ......................................................................... 40 Engagement Conclusions - Standard 14.5 ........................................................................................... 41 Engagement Documentation - Standard 14.6 ..................................................................................... 41 Principle 15 – Communicate Engagement Results and Monitor Action Plans ........................................ 42 Final Engagement Communication - Standard 15.1 ............................................................................ 42 Confirming the Implementation of Recommendations or Action Plans - Standard 15.2 ................... 44
Page 5
5 Introduction 1. The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Global Internal Audit Standards (GIAS). The GIAS, in the applicability to the public sector, must be considered along with the Code of Practice for the Governance of Internal Audit in the United Kingdom (Code) and the Local Government Application Note (Application Note) which have been produced to assist with the interpretation of the GIAS. 2. This Internal Audit Manual (the Manual) has been created to provide guidance to the Internal Audit function of Argyll and Bute Council (the Council) on its administration and audit approach to be adopted. The contents are guided by the requirement of the GIAS, the Code and the Application Note which provide further guidance on interpretation within the context of local government. The key areas are cross referenced to the appropriate section(s) in the GIAS, Code and Application Note. 3. The GIAS contain requirements to support 15 guiding principles associated with and expected to be operating within the Internal Audit function across 5 key domains; Purpose, Ethics and Professionalism, Governing, Managing and Performing, these domains and the 15 guiding principles are outlined in the images below.
Page 6
6 Purpose of Internal Audit – Domain I Definition of Internal Auditing (Glossary) 4. An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. Purpose Statement 5. The purpose of the internal audit function is to strengthen Argyll and Bute Council’s ability to create, protect, and sustain value by providing the Council and management with independent, risk- based, and objective assurance, advice, insight, and foresight. The internal audit function enhances the Council’s: • Successful achievement of its objectives. • Governance, risk management, and control processes. • Decision-making and oversight. • Reputation and credibility with its stakeholders. • Ability to serve the public interest. • Anti-fraud and corruption arrangements. • Section 95 Officer and Monitoring Officer roles. Internal Audit Mandate and Authority 6. Argyll and Bute Council’s internal audit function’s mandate is found in the Council Constitution at Appendix 1 to the Financial and Security Regulations.
Page 7
7 7. The internal audit function’s authority is created by its direct reporting relationship to senior management and the Audit and Scrutiny Committee. Such authority allows for unrestricted access to the Chair and Vice-Chair of the Audit and Scrutiny Committee. 8. Internal audit, with strict accountability for confidentiality and safeguarding records and information, has authorised full, free, and unrestricted access to any, and all of the Council’s records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist Internal Audit in fulfilling its roles and responsibilities. Internal Audit, through the CIA, will also have free and unrestricted access to the Committee. 9. The Council authorises the internal audit function and designated auditors to require and receive, without necessarily giving prior notice: • access to all records, documents and correspondence relating to any financial or other relevant transactions, including documents of a confidential nature • access at all reasonable times to any land, premises, officers and members of the Council • the production of any cash, stores or other property of the Council under an officer’s and member’s control • explanations concerning any matter under investigation. Ethics and Professionalism – Domain II Principle 1 – Demonstrate Integrity Overview 10. The purpose of a ‘Code of Ethics’ is to promote an ethical culture within the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, governance and control. A ‘Code of Ethics’ extends beyond the definition of internal auditing to include two essential components: • principles that are relevant to the profession and practice of internal auditing • rules of conduct that describe behaviour norms expected of internal auditors. Applicability and Enforcement 11. A ‘Code of Ethics’ applies to all of those who are commissioned to provide internal audit services to the Council. Suspected or known breaches of the ‘Code of Ethics’ should be referred to at least one of the following, as considered appropriate: • Chief Internal Auditor (CIA) • Executive Director Kirsty Flanagan (Section 95 Officer) • Executive Director Douglas Hendry (Monitoring Officer) • Audit and Scrutiny Committee (the Committee). Conformance 12. The CIA will ensure that internal auditors:
Page 8
8 • Conform with the GIAS, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote a supportive ethics-based culture in the organisation. • Report organisational behaviour that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures. Honesty and Professional Courage – Standard 1.1 13. All internal audit staff must act with honesty, integrity and professional courage due to the privileges and expectations of the role they carry out within the Council. Internal auditors must be truthful, accurate, clear, open and respectful in all professional relationships and communications, even when expressing scepticism or offering an opposing view point. Internal auditors must exhibit professional courage by communicating truthfully and taking appropriate action, even when confronted by dilemmas and difficult situations. 14. In the event that any internal audit staff feel pressurised or conflicted with any matter which they feel that they cannot deal with, they must escalate this to the CIA. The CIA will assess the situation and where appropriate intervene to address any concerns raised by internal audit staff. Organisational Ethical Expectations – Standard 1.2 15. All internal audit staff must understand, respect, meet and contribute to the legitimate and ethical expectations of the Council and must be able to recognise conduct that is contrary to those expectations. Furthermore, internal auditors must encourage and promote an ethics based culture in the organisation. If internal auditors identify behaviour within the organisation that is inconsistent with the organisations ethical expectations, they must report the concern according to the Council’s applicable policies and procedures. 16. The fact that a particular piece of ‘behaviour’ which has been identified as being possibly inappropriate is not specifically covered by, or mentioned within, the Council’s own ‘Code of Conduct’, does not necessarily prevent it from being unacceptable, discreditable or indeed unprofessional. 17. For members of the Chartered Institute of Internal Auditors, breaches of the ‘Code of Ethics’ will be evaluated and administered in line with the Institute’s disciplinary procedures. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. Such procedures are without prejudice to the Council’s own disciplinary procedures. 18. Qualified internal auditors could be members of one or more of the following institutions: Chartered Institute of Public Finance & Accountancy (CIPFA), the Chartered Institute of Management Accountants (CIMA), the Chartered Institute of Internal Auditors (CIIA) and the Association of Chartered Certified Accountants (ACCA). Each of these bodies have their own Code of Ethics which members are expected to comply with. Legal and Ethical Behaviour – Standard 1.3 19. Internal Auditors must not engage in or be party to any activity that is illegal or discreditable to the organisation or the profession of internal auditing or that may harm the Council or its employees.
Page 9
9 20. Internal auditors must understand and abide by the laws and/or regulations relevant to the Council, local government and the jurisdictions in which the Council operates, including making disclosures as required. Principle 2 – Maintain Objectivity 21. Internal auditors maintain an impartial and unbiased attitude when performing internal audit services and making decisions. 22. Objectivity is an unbiased mental attitude that allows internal auditors to make professional judgements, fulfil their responsibilities, and achieve the ‘Purpose of Internal auditing’ without compromise. An independently positioned internal audit function supports internal auditors’ ability to maintain objectivity. Individual Objectivity – Standard 2.1 23. Internal Auditors must maintain professional objectivity when performing all aspects of internal audit services. Professional objectivity requires internal auditors to apply an impartial and unbiased mindset and make judgements based on balanced assessment of all relevant circumstances. Safeguarding Objectivity – Standard 2.2 24. Internal Auditors must recognise and avoid or mitigate actual, potential and perceived impairments to objectivity. 25. Internal Auditors must not accept any tangible or intangible item, such as a gift, reward, favour, that may impair or be presumed to impair objectivity. 26. Internal Auditors must avoid conflicts of interest and must not be unduly influenced by their own interests or interests of others, including senior management or others in a position of authority, or by the political environment or other aspects of their surroundings. 27. When performing internal audit services: • Internal auditors must refrain from assessing specific activities for which they were previously responsible. Objectivity is presumed to be impaired if an auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous 12 months. • If the internal audit function is to provide assurance services where it previously performed advisory services, the CIA must confirm that the nature of the advisory services does not impair objectivity and must assign resources such as individual objectivity is managed. Assurance engagements for functions over which the CIA has responsibility must be overseen by an independent party outside the internal audit function. • If internal auditors are to provide advisory services relating to activities for which they had previous responsibilities, they must disclose potential impairments to the party requesting the services before accepting the engagement.
Page 10
10 Disclosing Impairments to Objectivity – Standard 2.3 28. If objectivity is impaired in fact or appearance, the details of the impairment must be disclosed promptly to the appropriate parties. 29. If internal auditors become aware of an impairment that may affect their objectivity, they must disclose the impairment to the CIA or a designated supervisor. If the CIA determines that an impairment is affecting an internal auditor’s ability to perform duties objectively, the CIA must discuss the impairment with the management of the activity under review, the board, and/or senior management and determine the appropriate action to resolve the situation. 30. If an impairment that affects the reliability or perceived reliability of the engagement findings, recommendations, and/or conclusions is discovered after an engagement has been completed, the CIA must discuss the concerns with the management of activity under review, the board, senior management, and/or other affected stakeholders and determine the appropriate actions to resolve the situations. (See also Standard 11.4 Errors and Omissions). Implementation of these requirements within Argyll and Bute Council will be as follows: 31. The CIA will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CIA determines that objectivity may be impaired, in fact or appearance, the details of the impairment will be disclosed to appropriate parties. 32. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance. 33. Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for Argyll and Bute Council or its affiliates. • Initiating or approving transactions external to the internal audit function. • Directing the activities of any Argyll and Bute Council employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors. 34. Internal auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to appropriate parties and at least annually, such as the CIA, Audit and Scrutiny committee, management, or others. • Exhibit professional objectivity in gathering, evaluating, and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. 35. The Chief Internal Auditor (CIA) will be positioned at a level in the organisation that enables internal audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the internal audit function. (See “Mandate” section.) The
Page 11
11 CIA will report to the Audit and Scrutiny Committee and to the Executive Director with responsibility as the Section 95 Officer of the Council and, in their absence to the Chief Executive. The CIA will also report to the Head of Financial Services for administrative purposes. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. 36. The CIA will confirm to the Audit and Scrutiny Committee, at least annually, the organisational independence of the internal audit function. If the governance structure does not support organisational independence, the CIA will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. 37. The CIA will disclose to the Audit and Scrutiny Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfil its mandate. Principle 3 – Demonstrate Competency 38. Internal Auditors apply knowledge, skills and abilities to fulfil their roles and responsibilities successfully. 39. Demonstrating competency requires developing and applying the knowledge, skills and abilities to provide internal audit services. Because internal auditors provide a diverse array of services, the competencies needed by each internal auditor vary. In addition to possessing or obtaining the competencies needed to perform services, internal auditors improve the effectiveness and quality of services by pursing professional development. Competency – Standard 3.1 40. Internal Auditors must possess or obtain the competencies to perform their responsibilities successfully. The required competencies include the knowledge, skills, and abilities suitable for one’s job position and responsibilities commensurate with their level of experience. Internal Auditors must possess or develop knowledge pf the IIA’s GIAS. 41. Internal Auditors must engage only in those services for which they have or can attain the necessary competencies. 42. Each internal auditor is responsible for continually developing and applying the competencies necessary to fulfil their professional responsibilities. The CIA must ensure that the internal audit function collectively possesses the competencies to perform the internal audit services described in the Internal Audit Charter or must obtain the necessary competencies. Continuing Professional Development – Standard 3.2 43. Internal Auditors must maintain and continually develop their competencies to improve the effectiveness and quality of internal audit services. Internal auditors must pursue continuing professional development including education and training. Practicing Internal Auditors who have attained professional internal audit certification must follow the continuing professional education policies and fulfil the requirements applicable to their certifications.
Page 12
12 Implementation of these requirements within Argyll and Bute Council will be as follows: 44. The Internal Audit team will work with proficiency and due professional care. The CIA shall be a CCAB accountant or CMIIA internal auditor with suitable internal audit experience. 45. The CIA is responsible for recruiting appropriate internal audit staff in accordance with the Council’s recruitment processes. As part of the role the CIA shall: • ensure that internal audit collectively possess or obtain the skills, knowledge and other competencies required to perform its responsibilities • obtain competent advice and assistance where internal audit does not possess the skills, knowledge and other competencies required to perform its responsibilities • ensure that internal auditors have sufficient knowledge to evaluate the risk of fraud and anti-fraud arrangements in the organisation • ensure that internal auditors have sufficient knowledge of key information technology risks and controls • ensure that internal auditors have sufficient knowledge of the appropriate computer- assisted audit techniques that are available to them to perform their work. 46. In addition, all staff who are on professional training programs must comply with their terms and conditions of practice and maintain the standards expected of the professional institute they belong to and other relevant requirements as outlined in this document. 47. All staff must maintain their continued professional development in accordance with their professional body on an annual basis and make the appropriate declaration where required. 48. All staff must view and attend professional webinars which are relevant to their professional institutes and which are deemed mandatory and which serves to allow professional reflection in future work or audit assignments. In addition, all professional members must undertake mandatory minimum training in ethics, this may differ between relevant professional bodies. 49. Argyll and Bute Council will assist with appropriate training and courses to allow staff to maintain and develop knowledge and competencies in the areas which they are required to audit now and in the future. 50. Internal Audit staff as part of their annual performance review, as part of the ‘Staff Conversation’ approach, will have a development plan consistent with their specific role within the function. Principle 4 – Exercise Due Professional Care 51. Internal Auditors apply due professional care in planning and performing internal audit services. 52. The Standards that embody exercising due professional care require: • Conformance with the GIAS. • Consideration of the nature, circumstances, and requirements of the work to be performed. • Application of professional scepticism to critically assess and evaluate information. 53. Due professional care requires planning and performing internal audit services with the diligence, judgement, and scepticism possessed by prudent and competent internal auditors. When
Page 13
13 exercising due professional care, internal auditors perform in the best interests of those receiving internal audit services but are not expected to be infallible. Conformance with the Global Internal Audit Standards – Standard 4.1 54. Internal Auditors must plan and perform internal audit services in accordance with the GIAS. 55. The internal audit function’s methodologies must be established. Documented and maintained in alignment with the GIAS. Internal Auditors must follow the GIAS and the internal audit function’s methodologies when planning and performing internal audit services and communicating results. 56. If the GIAS are used in conjunction with the requirements issued by other authoritative bodies, internal audit communication must also cite the use of the other requirements, as appropriate. 57. If laws or regulations prohibit internal auditors or internal audit functions from conforming with any part of the GIAS, conformance with all other parts of the GIAS is required and appropriate disclosures must be made. 58. When internal audits are unable to conform with a requirement, the CIA must document and communicate a description of the circumstance, alternative actions taken, the impact of the actions, and the rationale. Requirements related to disclosing non-conformance with the GIAS are described in Standards 8.3 Quality, 12.1 Internal Quality Assessment, and 15.1 Final Engagement Communications. Due Professional Care – Standard 4.2 59. Internal Auditors must exercise due professional care by assessing the nature, circumstances, and requirements of the services to be provided, including: • The organisations strategy and objectives • The interests of those for whom internal audit services are provided and the interests of other stakeholders • Adequacy and effectiveness of governance, risk management and control processes • Cost relative to potential benefits of the internal audit services to be performed • Extent and timeliness of work needed to achieve the engagement’s objectives • Relative complexity, materiality, or significance of risks to the activity under review • Probability of significant errors, fraud, non-compliance, and other risks that might affect objectives, operations and resources • Use of appropriate techniques, tools and technology. Professional Scepticism – Standard 4.3 60. Internal Auditors must exercise professional scepticism when planning and performing internal audit services. 61. To exercise professional scepticism, internal auditors must: • Maintain an attitude that includes inquisitiveness • Critically assess the reliability of information • Be straightforward and honest when raising concerns and asking questions about inconsistent information
Page 14
14 • Seek additional evidence to make a judgement about information and statements that might be incomplete, inconsistent, false or misleading. Implementation of these requirements within Argyll and Bute Council will be as follows: 62. All staff will approach their work taking full cognisance of the GIAS and those within Argyll and Bute Council’s Constitution, together with any other relevant requirements or guidance deemed appropriate. 63. In completing planning activities and subsequent audit work internal auditors shall consider the: • extent of work needed to achieve the engagement’s objectives • relative complexity, materiality or significance of matters to which assurance procedures are applied • adequacy and effectiveness of governance, risk management and control processes • probability of significant errors, fraud, or non-compliance • cost of assurance in relation to potential benefits. 64. Internal auditors will exercise due professional care during a consulting engagement by considering the: • needs and expectations of clients, including the nature, timing and communication of engagement results • relative complexity and extent of work needed to achieve the engagement’s objectives • cost of the consulting engagement in relation to potential benefits. 65. The CIA will ensure that regular conversations take place about performance, behaviours and career/development aspirations in line with the Council’s -approach to the PRD process, ‘Staff Conversations’, this will be undertaken on an annual basis. 66. Internal Auditors must approach their work with appropriate professional scepticism, taking cognisance of the need to take that independent thought process, to critically assess and validate information provided, seeking further evidence or alternative external evidence where required and have the mindset to challenge information from clients which is deemed inconsistent, unreliable and raise questions, queries and seek clarification where that is required. In Argyll and Bute Council and consistent with all public bodies, there is a need to be open, honest and transparent in the workings of the Council and its staff and there is an expectation of challenge and verification through the audit process. 67. In the event that evidence is provided to internal audit staff which is deemed to be misleading or false, this must be reported to the CIA who will further assess the circumstances and where appropriate escalate the matter with relevant senior management. Principle 5 – Maintain Confidentiality 68. Internal Auditors use and protect information appropriately. 69. Because internal auditors have unrestricted access to the data, records, and other information necessary to fulfil the internal audit mandate, they often receive information that is confidential,
Page 15
15 proprietary, and/or personally identifiable. This includes information in physical and digital form as well as information derived from oral communication, such as formal or informal meeting discussions. Internal auditors must respect the value and ownership of information they receive by using it only for professional purposes and protecting it from unauthorised access or disclosure, internally and externally. Use of Information – Standard 5.1 70. Internal Auditors must follow relevant policies, procedures, laws, and regulations when using information. The information must not be used for personal gain or in a manner contrary or detrimental to the organisation’s legitimate and ethical objectives. Protection of Information – Standard 5.2 71. Internal Auditors must be aware of their responsibilities for protecting information and demonstrate respect for the confidentiality, privacy, and ownership of information acquired when performing internal audit services or as the result of professional relationships. 72. Internal auditors must understand and abide by the laws, regulations, policies, and procedures related to confidentiality, information privacy, and information security that apply to the organisation and internal audit function. 73. Considerations specifically relevant to the internal audit function include: • Custody, retention, and disposal of engagement records • Release of engagement records to internal and external parties • Handling of, access to, or copies of confidential information when it is no longer needed. 74. Internal Auditors must not disclose confidential information to unauthorized parties unless there is a legal or professional responsibility to do so. 75. Internal Auditors must manage the risk of exposing or disclosing information inadvertently. 76. The CIA must ensure that the internal audit function and individuals assisting the internal audit function adhere to the same protection requirements. Implementation of these requirements within Argyll and Bute Council will be as follows: 77. Internal auditors must: • act prudently when using information acquired in the course of their duties and protect that information • not disclose or misuse information obtained during the course of their work • take cognisance of the Council’s documentation retention and handling policy • secure all and any information they have and store it in an appropriate audit directory; printed or manual records must be secured at all times, particularly when not in a controlled environment • not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the Council • inform the CIA should they have any concerns about non-compliance with these requirements as soon as practicably possible.
Page 16
16 Governing the Internal Audit Function – Domain III Principle 6 – Authorised by the Board 78. The Board establishes, approves, and supports the mandate of the internal audit function. 79. The internal audit function receives its mandate from the Board (or applicable law in certain public sector environments). The mandate specifies the authority, role, and responsibilities of the internal audit function and is documented in the Internal Audit Charter. The mandate empowers the internal audit function to provide the Board and senior management with objective assurance, advice, insight, and foresight. The internal audit function carries out the mandate by bring a systematic, disciplined approach to evaluating and improving the effectiveness of governance, risk management, and control processes throughout the organisation. Internal Audit Mandate – Standard 6.1 80. The CIA must provide the Board and senior management with information necessary to establish the internal audit mandate. In those jurisdictions and industries where the internal audit function’s mandate is prescribed wholly or partially in laws or regulations, the Internal Audit Charter must include the legal requirements of the mandate. 81. To help the Board and senior management determine the scope and types of internal audit services, the CIA must co-ordinate with other internal and external assurance providers to gain an understanding of each other’s roles and responsibilities. (Other references – Standard 9.5 Co- ordination and Reliance) 82. The CIA must document or reference the mandate in the Internal Audit Charter, which is approved by the Board. 83. Periodically, the CIA must assess whether changes in circumstances justify a discussion with the Board and senior management about the Internal Audit Mandate. If so, the CIA must discuss the Internal Audit Mandate with the Board and senior management to assess whether the authority, role, and responsibilities continue to enable the internal audit function to achieve its strategy and accomplish its objectives. Internal Audit Charter – Standard 6.2 84. The CIA must develop and maintain an Internal Audit Charter that specifies, at a minimum, the internal audit function’s: • Purpose of Internal Auditing. • Commitment to adhering to the GIAS. • Mandate, including scope and types of services to be provided, and the Board’s responsibilities and expectations regarding management’s support to the internal audit function. • Organisational position and reporting relationships.
Page 17
17 85. The CIA must discuss the proposed Charter with the Board and Senior Management to confirm that it accurately reflects their understanding and expectations of the internal audit function. Board and Senior Management Support – Standard 6.3 86. The CIA must provide the Board and senior management with information needed to support and promote the recognition of the internal audit function throughout the organisation. 87. The CIA must coordinate the internal audit function’s Board communications with senior management to support the Boards ability to fulfil its requirements. Implementation of these requirements within Argyll and Bute Council will be as follows: 88. The CIA will as a minimum will comply with the requirements outlined in Principle 6 and its constituent Standards 6.1-6.3. The primary mandate in relation to Scottish Local Authorities is outlined in the Local Authority Accounts (Scotland) Regulations 2014 and the Constitutional Documents of the Council. 89. A Charter and Audit Manual will be produced and reviewed annually in order to maintain a level of documented and routine overview of these core documents. Any changes will be discussed with management and through presentation with the Board on any such changes that may be considered or required. 90. The CIA and management will keep the Audit and Scrutiny Committee informed and updated of any change where it is considered to impact the role and discharge of the internal audit function within the Council or required to promote the internal audit function throughout the organisation as required. Principle 7 – Positioned Independently 91. The Board establishes and protects the internal audit function’s independence and qualifications. 92. The Board is responsible for enabling the independence of the internal audit function. Independence is defined as the freedom from conditions that impair the internal audit function’s ability to carry out its responsibilities in an unbiased manner. The internal audit function is only able to fulfil the ‘Purpose of Internal Auditing’ when the CIA reports directly to the Board, is qualified, and is positioned at a level within the organisation that enables the internal audit function to discharge its services and responsibilities without interference. Organisational Independence – Standard 7.1 93. The CIA must confirm to the Board the organisational independence of the internal audit function at least annually. This includes communicating incidents where independence may have been impaired and the actions or safeguards employed to address the impairment. 94. The CIA must document in the Internal Audit Charter the reporting relationships and organisational positioning of the internal audit function, as determined by the Board. 95. The CIA must discuss with the Board and senior management any current or proposed roles and responsibilities that have the potential to impair the internal audit function’s independence, either
Page 18
18 in fact or appearance. The CIA must advise the Board and senior management of the types of safeguards to manage actual, potential or perceived impairments. 96. When the CIA has one or more ongoing roles beyond internal auditing, the responsibilities, nature of work, and established safeguards must be documented in the Internal Audit Charter. If those areas of responsibility are subject to internal auditing, alternative processes to obtain assurance must be established, such as contracting with an objective, competent external assurance provider that reports independently to the Board. 97. When the CIA’s non audit responsibilities are temporary, assurance for those areas must be provided by an independent third party during the temporary assignment and for the subsequent 12 months. Also the CIA must establish a plan to transition those responsibilities to management. Implementation of these requirements within Argyll and Bute Council will be as follows: 98. The CIA will as part of his/her annual report outline the status of its organisational objectivity, together with outlining any concerns regarding any incidents where independence may have been impaired and the actions or safeguards employed to address the impairment, where applicable. 99. In Argyll and Bute Council, the CIA reports in his/her name to the Council’s Audit and Scrutiny Committee directly, is appropriately qualified and experienced and reports directly to the Section 95 Officer and has access to the Chief Executive and Monitoring Officer. This both maintains independence and positions the CIA within the organisation to discharge the function of internal audit and its responsibilities without interference. Chief Audit Executive (CIA) Qualifications – Standard 7.2 100. The CIA must help the Board understand the qualifications and competencies of a CIA that are necessary to manage the internal audit function. The CIA facilitates this understanding by providing information and examples of common and leading qualifications and competencies. 101. The CIA must maintain and enhance the qualifications and competencies necessary to fulfil the roles and responsibilities expected by the Board. Implementation of these requirements within Argyll and Bute Council will be as follows: 102. In Argyll and Bute Council there will be a strict requirement to comply with Standard 7.2. and this is achieved by; • The CIA, as part of the annual reporting and self assessment section and that which requires compliance with the GIAS will confirm the qualifications that are acceptable for the holding of a CIA post, specifically, CCAB or Charted Internal Auditor • The CIA maintains these qualifications and that appropriate competencies have been maintained and that continued professional development has been achieved. Principle 8 – Overseen by the Board 103. Board oversight is essential to enable the overall effectiveness of the internal audit function. Achieving this principle requires collaboration and interactive communications between the Board
Page 19
19 and the CIA as well as the Board’s support in ensuring the internal audit function obtains sufficient resources to fulfil then internal audit mandate. Additionally, the Board receives assurance about the quality of performance of the CIA and the internal audit function through the quality assessment and improvement program, including the Board’s direct review of the results of the external quality assessment. Board Interaction – Standard 8.1 104. The CIA must provide the Board with the information needed to conduct its oversight responsibilities. This information may be specifically requested by the Board or may be, in the judgement of the CIA, valuable for the Board to exercise its oversight responsibilities. 105. The CIA must report to the Board and Senior Management: • The internal audit plan, budget and subsequent significant revisions to them • Changes potentially affecting the mandate or charter • Potential impairments to independence • Results of internal services, including conclusions, themes, assurance, advice, insights, and monitoring results • Engagement conclusions and confirming the implementation of recommendations or actions plans • Results from the quality assurance and improvement program. 106. There may be instances when the CIA disagrees with senior management or stakeholders on the scope, findings, or other aspects of an engagement that may affect the ability of the internal audit function to execute its responsibilities. In such cases, the CIA must provide the Board with the facts and circumstances to allow the Board to consider whether, in its oversight role, it should intervene with senior management or other stakeholders. Implementation of these requirements within Argyll and Bute Council will be as follows: 107. In Argyll and Bute Council the CIA will prepare an annual audit plan which will outline the minimum resources required to achieve the plan, this will confirm that there are appropriate staffing and budget to enable fulfilment of the plan. 108. The Internal Audit Charter and Internal Audit Manual are reviewed annually and presented to the audit and Scrutiny Committee outlining changes required to maintain compliance with best practice and where required minor updates due to changes within the Council. Any changes affecting the mandate or charter will be specifically outlined to allow discussion, consideration and decision by the Committee. 109. In Argyll and Bute Council, the CIA will produce quarterly reports for the Audit and Scrutiny Committee, this will include any variations to the plan, in addition, all audit work completed is formally reported to the Audit and Scrutiny Committee, including findings, conclusions and recommendations along with agreed action plans. 110. All quality assurance assessments both internal and external are and will continue to be reported to the Audit and Scrutiny Committee as a matter of routine. Internally, on an annual basis as part of the annual reporting and externally every five years by the report issued from the independent assessor.
Page 20
20 Resources – Standard 8.2 111. The CIA must evaluate whether internal audit resources are sufficient to fulfil the internal audit mandate and achieve the internal audit plan. If not, the CIA must develop a strategy to obtain sufficient resources and inform the Board about the impact of insufficient resources and how any shortfalls will be addressed. Implementation of these requirements within Argyll and Bute Council will be as follows: 112. The CIA will as part of the draft Audit Plan provide commentary regarding the resources required to deliver the plan and whether there has been sufficient budgetary provision. Any concerns or deficiencies identified by the CIA, where applicable will be communicated. Quality – Standard 8.3 113. The CIA must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program includes two types of assessments: • External Assessments • Internal Assessments 114. At least annually, the CIA must communicate the results of the internal quality assessment to the Board and senior management. The results of the external quality assessments must be reported when completed. In both cases such communications include: • The internal audit function’s conformance with the GIAS and achievement of performance objectives • If applicable, compliance with laws and/or regulations relevant to internal auditing • If applicable, plans to address the internal audit function’s deficiencies and opportunities for improvement. Implementation of these requirements within Argyll and Bute Council will be as follows: 115. In Argyll and Bute Council, the CIA will, as part of the annual report to Committee, confirm whether conformance to the GIAS has been achieved and where not, the reasons why and any remedial action required going forward as part of an action plan. In relation to External assessments, these will be reported to the next scheduled meeting of the Committee on receipt of the final report, this will include all findings and an action plan to address all such issues, where applicable. External Quality Assessment – Standard 8.4 116. The CIA must develop a plan for an external quality assessment and discuss the plan with the Board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation. Implementation of these requirements within Argyll and Bute Council will be as follows: 117. The Council have agreed to participate in the Scottish Local Authority Chief Internal Auditors (SLACIAG) external assessment review process. A qualified and experienced CIA from another local authority will undertake a comprehensive review in accordance with the GIAS and report their
Page 21
21 findings to the CIA of Argyll and Bute Council, the Audit and Scrutiny Committee, the Section 95 Officer and Chief Executive. 118. The qualifications and experience of the assessor will be made clear in the assessment report produced for the Committee and other appropriate senior management. Managing the Internal Audit Function – Domain IV Principle 9 – Plan Strategically 119. The CIA plans strategically to position the internal audit function to fulfil its mandate and achieve long-term success. 120. Planning strategically requires the CIA to understand the internal audit mandate and organisational governance, risk and control processes. A properly resourced and positioned internal audit function develops and implements a strategy to support the organisation success. In addition, the CIA creates and implements methodologies to guide the internal audit function and develop the internal audit plan. Understanding Governance, Risk Management and Control Processes – Standard 9.1 121. To develop an effective internal audit strategy and plan, the CIA must understand the organisation’s governance, risk management and control processes. 122. To understand governance processes, the CIA must consider how the organisation: • Establishes strategic objectives and makes strategic and operational decisions • Oversees risk management and control • Promotes an ethical culture • Delivers effective performance management and accountability • Structures its management and operating functions • Communicates risk and control information throughout the organisation • Coordinates activities and communications among the Board, internal and external providers of assurance services, and management. 123. To understand risk management and control processes, the CIA must consider how the organisation identifies and assesses significant risks and selects appropriate control processes. This includes understanding how the organisation identifies and manages the following key risk areas: • Reliability and integrity of financial and operational information • Effectiveness and efficiency of operations and programs • Safeguarding of assets • Compliance with laws and/or regulations. Implementation of these requirements within Argyll and Bute Council will be as follows:
Page 22
22 124. The Council has a strong and well developed governance system in place which is supported by appropriate policies, procedures and expected practice. Systems of governance are reviewed periodically and where appropriate updated within the Council. As expected, local government is highly controlled within the context of openness and accountability and requires that appropriate oversight is in place. 125. The CIA is an integral part of the risk management process and co-ordinates the updates of the Council’s Strategic Risk Register (SRR), this allows insight to the reasoning and rationale of senior management in the developing horizon of risk. The CIA liaises with senior management and prepares a paper for the Council’s Senior Management Team (SMT) on these draft updates which are challenged before being agreed/approved. 126. The Audit and Scrutiny Committee receive an annual update of the SRR and outline of the key risks, treatment of the risks and mitigations in place to reduce risk where appropriate and the residual risk score, such information is usually presented to Committee in September of each year. 127. As part of the understanding the control processes, a number of approaches are taken by the CIA, these include but are not limited to the review of Council agendas and minutes, the review of Council strategies and objectives, reports of regulators’ discussions with senior management and any outstanding legal or regulatory matters which may pose a risk to the Council. In addition, the process for recording, monitoring and assessing asset management, reliability of core financial systems are among the other areas considered. Internal Audit Strategy - Standard 9.2 128. The CIA must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation and aligns with the expectations of the Board, senior management, and other key stakeholders. 129. An internal audit strategy is a plan of action designed to achieve long-term or overall objective. The internal audit strategy must include vision, objectives, and supporting initiatives for the internal audit function. An internal audit strategy helps guide the internal audit function towards fulfilment of the internal audit mandate. 130. The CIA must review the internal audit strategy with the Board and senior management periodically. Implementation of these requirements within Argyll and Bute Council will be as follows: 131. An Internal Audit Strategy will be developed for a three year period, with each year supported by an annual audit plan. The Internal Audit Strategy will be linked and cross referenced to key risks contained within the SRR and the Council’s organisational objectives which have been set and agreed. This will allow a complete picture of the visions, objectives and outcomes which the Council are planning to achieve but also how internal audit are aligning its resources for that purpose taking cognisance of the risk based approach. 132. The Internal Audit Strategy will be discussed with senior management and considered by each of the relevant Department Management Teams (DMT) to allow discussions and comment. Similarly,
Page 23
23 then presented to the Audit and Scrutiny Committee along with the relevant annual plan in order that there is opportunity for review, comment and decision. Methodologies - Standard 9.3 133. The CIA must establish methodologies to guide the internal audit function in a systematic and disciplined manner to implement the internal audit strategy, develop the internal audit plan, and conform with the GIAS. The CIA must evaluate the effectiveness of the methodologies and update them as necessary to improve the internal audit function and respond to significant changes that affect the function. The CIA must provide internal auditors with training methodologies. Implementation of these requirements within Argyll and Bute Council will be as follows: 134. There are specific process and procedures in place within the internal audit function which require auditors to assess, plan and undertake their work in a coordinated and systematic way which allows consistency of approach, documented collection of appropriate data and information, checking and assessing the risk profile of each review, liaising with other stakeholders such as external audit and use statistical information and techniques as required. These are some of the processes used in our standard operating practice which allow reviews to be undertaken, which will help to form conclusions and recommendations where that is appropriate. Internal Audit Plan - Standard 9.4 135. The CIA must create an internal audit plan that supports the achievement of the organisation’s objectives. 136. The CIA must base the internal audit plan on a documented assessment of the organisation’s strategies, objectives and risks. This assessment must be informed by input from the Board and senior management as well as the CIA’s understanding of the organisation’s governance, risk management, and control processes. The assessment must be performed at least annually. 137. The internal audit plan must: • Consider the internal audit mandate and the full range of agreed internal audit services • Specify internal audit services that support the evaluation and improvement of the organisation’s governance, risk management and control processes • Consider the coverage of information technology governance, fraud risk, the effectiveness of the organisation’s compliance and ethics programs, and other high risk areas • Identify the necessary human, financial and technological resources necessary to complete the plan • Be dynamic and update timely in responses to the organisation’s business, risk operations, programs, systems, controls, and organisational culture. Implementation of these requirements within Argyll and Bute Council will be as follows: 138. The CIA will produce an annual internal audit plan which will flow from the internal audit strategy which covers the key objectives of the Council, its strategies and consider risk profiles from the SRR. The strategy and subsequent plans will cover the assessment of governance arrangements, risk management and controls. The focus on control improvement will also be undertaken when reviewing information technology, fraud risk and consideration of ethics and organisation culture.
Page 24
24 139. The plan will outline the services that will be provided, the resources required to deliver the plan both in terms of time but also the skills mix required to provide the added assurance that the work meets the highest standards and quality. 140. The CIA will review the proposed plan with relevant senior staff and seek approval through the relevant Departmental Management Team (DMT), together with seeking views from stakeholders and Members of the Audit and Scrutiny Committee. Any changes which are deemed significant and will be required to be addressed will be redelivered through a small contingency within the limited resources envelope of the internal audit function. Coordination and Reliance - Standard 9.5 141. The CIA must coordinate with internal and external providers of assurance services and consider relying upon their work. Coordination of services minimises duplication of effort, highlight gaps in coverage of key risks, and enhances the overall value added by providers. 142. If unable to achieve appropriate level of coordination, the CIA must raise any concerns with senior management and, if necessary, the Board. 143. When the internal audit function relies on the work of other assurance service providers, the CIA must document the basis for the reliance and is still responsible for the conclusions reached by the internal audit function. Implementation of these requirements within Argyll and Bute Council will be as follows: 144. The CIA will liaise with the appointed External Auditor to assess and determine the coordination of our respective roles and responsibilities in relation to the delivery of audit services. Where possible and in accordance with established practices reliance and/or reference will be made to our respective coverage to minimise repetition of work. 145. Any issues that cannot be resolved would be escalated to the appropriate officer within the Council and relevant senior manager/partner within the provider of our external audit services. 146. There is a duty of care and risk when relying on the work of other bodies, assurance providers and sources and these will be assessed by the relevant auditor when he/she determines if that source of information can be relied upon or merely made reference to as required. Principle 10 – Managing Resources 147. The CIA manages resources to implement the internal audit function’s strategy and achieve its plan and mandate. 148. Managing resources requires obtaining and deploying financial, human, and technological resources effectively. The CIA needs to obtain the resources required to perform internal audit responsibilities and deploy resources according to the methodologies established for the internal audit function. Financial Resource Management - Standard 10.1 149. The CIA must manage the internal audit function’s financial resources.
Page 25
25 150. The CIA must develop a budget that enables the successful implementation of the internal audit strategy and achievement of the plan. The budget includes the resources necessary for the function’s operation, including training and acquisition of technology and tools. The CIA must manage the day to day activities of the internal audit function effectively and efficiently, in alignment with the budget. 151. The CIA must seek budget approval from the Board. The CIA must communicate promptly the impact of insufficient financial resources to the Board and senior management. Implementation of these requirements within Argyll and Bute Council will be as follows: 152. The application if this Standard within the context of the public sector will follow the supplementary guidance issued by the Chartered Institute of Public Finance and Accountancy, called ‘ Application Note: Global Internal Audit Standards in the UK Public Sector’ and which is effective from the 1st April 2025. This allows variations which are necessary for the UK public sector and which can be accommodated in terms of our approach to implementation. (The Audit Committee do not normally approve the financial budget of the internal audit function in UK Local Authorities). 153. In local government, in general, a formal budget process forms an integral part of the assessment of costs associated with the provision of a service, including internal audit. Internal audit will follow this process as will other sections within the Council. However, both the CIA and Board should be satisfied that there is appropriate budget to allow the delivery of the plan in order that appropriate assurance can be provided to inform those charged with governance, and an opinion in relation to the arrangements for governance, risk management and internal control each year by the CIA. It is therefore important that when the plan is being presented to the Board, the CIA makes reference to any specific concerns he/she may have in relation to financial resources in order that the Board can, in the event that there are any concerns about budgetary provision regarding internal audit, be escalated. 154. It would be normal that such agreement between management and the CIA on the provision of budgetary resource would have been agreed in advance. Human Resource Management - Standard 10.2 155. The CIA must establish an approach to recruit, develop, and retain internal auditors who are qualified to successfully implement the internal audit strategy and achieve the internal audit plan. 156. The CIA must strive to ensure that human resources are appropriate, sufficient, and effectively deployed to achieve the approved internal audit plan. Appropriate refers to the mix of knowledge, skills and abilities; sufficient refers to the quantity of resources; and effective deployment refers to assigning resources in a way that optimizes the achievement of the internal audit plan. 157. The CIA must communicate with the Board and senior management regarding the appropriateness and sufficiency of the internal audit function’s human resources. If the function lacks appropriate and sufficient human resources to achieve the internal audit plan, the CIA must determine how to obtain the resources or communicate timely to the Board and senior management the impact of the limitations. Implementation of these requirements within Argyll and Bute Council will be as follows:
Page 26
26 158. Professional staff will have an appropriate qualification such as Chartered Internal Auditor or CCAB qualified, other staff will either be part of a formal training programme to achieve a professional qualification or have a specific development plan relevant to the post. Staff will have appropriate Job Descriptions and Specifications. 159. Staff will be supported and allocated to internal audit work where they have the necessary skills and abilities or where they can be supervised in order to gain these skills as part of the professional training programme. 160. Specific competency frameworks will be used to assess staff, particularly at a professional level in order that skills and knowledge can be maintained so that added value can be provided when undertaking reviews. 161. In the public sector the ability of staff to develop and learn tend to be good, particularly in areas where there are key shortages of professional staff within the general market, such as Internal Audit. Argyll and Bute Council have well established routes for staff to learn and succeed such as ‘Growing our Own’ 162. The CIA will inform senior management and the Board of any concerns or developing issues relating to staffing within the internal audit function which would put at risk the delivery of the plan. The CIA outlines the staff and skills mix as part of the annual internal audit plan. In addition, a well developed training program is in place for the development of staff in order to achieve a relevant professional qualification. 163. Staff will be supported and a comprehensive set of human resource policies and procedures are in place within the Council to facilitate that which is expected of a well-regarded and ethical employer. Technological Resources - Standard 10.3 164. The CIA must strive to ensure that the internal audit function has technology to support the internal audit process. The CIA must regularly evaluate the technology used by the internal audit function and pursue opportunities to improve effectiveness and efficiency. 165. When implementing new technology, the CIA must implement appropriate training for internal auditors in the effective use of technological resources. The CIA must collaborate with the organisation’s information technology and information security functions to implement technological resources properly. 166. The CIA must communicate the impact of technology limitations on the effectiveness or efficiency of the internal audit function to the Board and senior management. Implementation of these requirements within Argyll and Bute Council will be as follows: 167. The Council has implemented a process where appropriate IT resources are provided based on needs and requirements to deliver the service. The Council’s internal audit function works largely remotely from home and are reliant on the IT infrastructure and support which is well developed within the Council. 168. Internal Audit staff will receive support and training on any new systems as required and currently receive regular training and updates in IT security as part of the corporate IT strategy.
Page 27
27 169. Where appropriate the Internal Audit function will use IT based technology for data extraction, sampling and validation. All and any support for IT will be made through the Council’s IT service. Principle 11 – Communicate Effectively 170. The CIA guides the internal audit function to communicate effectively with stakeholders. 171. Effective communication requires building relationships, establishing trust, and enabling stakeholders to benefit from the results of internal audit services. The CIA is responsible for helping the internal audit function establish ongoing communication with stakeholders to build trust and foster relationships. Additionally, the CIA oversees the internal audit function’s formal communications with the Board and senior management to enable quality and provide insights based on the results of the internal audit services. Building Relationships and Communicating with stakeholders - Standard 11.1 172. The CIA must develop an approach for the internal audit function to build relationships and trust with key stakeholders, including the Board, senior management, operational management, regulators, and internal and external assurance providers and other consultants. 173. The CIA must promote formal and informal communication between the internal audit function and stakeholders, contributing to the mutual understanding of: • Organisational interests • Approaches for identifying and managing risks and providing assurance • Roles and responsibilities of relevant parties and opportunities for collaboration • Relevant regulatory requirements • Significant organisational processes, Including financial reporting. Implementation of these requirements within Argyll and Bute Council will be as follows: 174. The CIA and Internal Audit function acknowledge the importance of good and appropriate relationships and communications with all relevant stakeholders. In addition, there are numerous opportunities of engagement with the CIA through regular contact both formal and informal as part of the role. 175. Appropriate training and induction of Members of the Committee which covers a wide programme of subject areas, to help build up knowledge and key skills expected of those charged with governance duties. This is further supported by development topics, presentations from key stakeholders such as Audit Scotland, Treasury Management providers and other events as deemed required. Effective Communication - Standard 11.2 176. The CIA must establish and implement methodologies to promote accurate, objective, clear, concise, constructive, complete, and timely internal audit communications. Implementation of these requirements within Argyll and Bute Council will be as follows:
Page 28
28 177. Communicating the results of our internal audit work is a crucial aspect of the audit process and is the key link to our stakeholders including the SMT, Heads of Service, Elected Members, the Committee and (where appropriate) the public. Criteria for Communicating 178. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. This provides a clear, concise, logical and easily referenced and understood format for stakeholders. Any deviation from the template report requires approval by the CIA. 179. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy and in a constructive manner which will help the Council. This will generally be carried out at a clearance meeting and a template has been created to facilitate and document that meeting. 180. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 181. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 182. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety, this disagreement will be reported to the Committee as and when the report is presented. 183. In completing internal audit activities, auditors are required to include and disclose all material facts identified as part of their objective audit work and subsequent reports which, if not disclosed, could distort their reports or conceal unlawful practice. Such disclosures should be made with reference to confidentiality requirements or other considerations that may preclude the release of information into the public domain which are primarily outlined in Schedule 7A Exempt Information – Local Government (Scotland) Act 1973 or as amended. 184. The work of Internal Audit should always seek to ensure that communications are accurate, objective, clear, concise, constructive, complete, and timely. Communicating Results - Standard 11.3 185. The CIA must communicate the results of internal audit services to the Board and senior management periodically and for each engagement as appropriate. The CIA must understand the expectations of the Board and senior management regarding the nature and timing of communications. 186. The results of internal audit services can include: • Engagement conclusions • Themes such as effective practices or root causes
Page 29
29 • Conclusions at the level of the business unit or organisation. Implementation of these requirements within Argyll and Bute Council will be as follows: 187. The CIA will make arrangements to communicate and clear reports with relevant senior managers, thereafter make arrangements for reports to be placed on the next scheduled meeting of the Committee unless there are specific matters which require to be concluded, for example legal and/or disciplinary matters. The Committee have a pre-agreed set of scheduled meetings within the Council meeting calendar and which are well communicated. 188. The CIA will brief the Chair and Vice/Chair as part of the Pre-Agenda meetings so that specific matters can be focused on within the Committee where there is a specific need or where there could be particular concern(s). 189. As part of the Committee’s annual report to Council, an overview of all audits undertaken over the relevant financial year are outlined to identify trends in levels of assurance and/or identify areas of particular concern or control weakness, where applicable. Errors and Omissions - Standard 11.4 190. If a final engagement communication contains a significant error or omission, the CIA must communicate corrected information promptly to all parties who received the original communication. 191. Significance is determined according to criteria agreed by the Board. Implementation of these requirements within Argyll and Bute Council will be as follows: 192. It is the CIA’s responsibility to ensure that where a final report contains a significant error or omission, subsequent changes, revisions or corrections are communicated to all parties who received the original communication. Communicating the Acceptance of Risk - Standard 11.5 193. The CIA must communicate unacceptable levels of risk. 194. When the CIA concludes that management has accepted a level of risk that exceeds the organisation’s risk appetite or risk tolerance, the matter must be discussed with senior management. If the CIA determines that the matter has not been resolved by senior management, the matter must be escalated to the Board. It is not the responsibility of the CIA to resolve the risk. Implementation of these requirements within Argyll and Bute Council will be as follows: 195. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety, this disagreement will be reported to the Committee as and when the report is presented. 196. It will not be the duty of the CIA to resolve the risk.
Page 30
30 Principle 12 – Enhance Quality 197. The CIA is responsible for the internal audit function’s performance with the GIAS and continuous performance improvement. 198. Quality is a combined measure of conformance with the GIAS and the achievement of the internal audit’s function’s performance objectives. Therefore, a quality assurance and improvement program is designed to evaluate and promote the internal audit functions’ conformance with the GIAS, achievement of performance objectives, and pursuit of continuous improvement. The program includes internal and external assessment. 199. The CIA is responsible for ensuring that the internal audit function is continuously seeking improvement. This requires developing measures to assess the performance of internal audit engagements, internal auditors, and the internal audit function. These measures form the basis for evaluating progress towards performance objectives including continuous improvement. Internal Quality Assessment - Standard 12.1 200. The CIA must develop and conduct internal assessments of the internal audit function’s conformance with the GIAS and progress towards performance objectives. 201. The CIA must establish a methodology for internal assessments, as described in Standard 8.3 Quality, that includes: • Ongoing monitoring of the internal audit function’s conformance with the GIAS and progress towards performance objectives • Periodic self-assessments or assessments by other persons within the organisation with sufficient knowledge of internal audit practices to evaluate conformance with the GIAS • Communication with the Board and senior management about the results of internal assessments. 202. Based on the results of periodic self-assessments, the CIA must develop action plans to address instances of non-conformance with the GIAS and opportunities for improvement, including a proposed timeline for actions. The CIA must communicate the results of the periodic self- assessment and action plans to the Board and senior management. 203. Internal assessments must be documented in the evaluation conducted by an independent third party as part of the organisation’s external quality assessment. 204. If non-conformance with the GIAS affects the overall scope of the operation of the internal audit function, the CIA must disclose to the Board and senior management the non-conformance and its impact. Implementation of these requirements within Argyll and Bute Council will be as follows: 205. The CIA uses the methodology for the internal quality assessment by use of ‘Local Government Application Note’ assessment tool. This allows cross referencing of the requirements contained within the GIAS, together with any subsequent adjustments for the UK public sector internal audit providers. This assessment is reported annually to the Audit and Scrutiny Committee, and where appropriate, any action plan that would need to be implemented to address any gaps identified, along with an appropriate timeline.
Page 31
31 206. All assessments are documented and retained. Performance Measurement - Standard 12.2 207. The CIA must develop objectives to evaluate the internal audit function’s performance. The CIA must consider the input and expectations of the Board and senior management when developing the performance objectives. 208. The CIA must develop a performance measurement methodology to progress towards achieving the function’s objectives and to promote the continuous improvement of the internal audit function. 209. When assessing the internal audit function’s performance, the CIA must solicit feedback from the Board and senior management as appropriate. 210. The CIA must develop an action plan to address issues and opportunities for improvement. Implementation of these requirements within Argyll and Bute Council will be as follows: 211. Performance measures are aligned to the objectives contained in within the Charter, Audit Strategy and Annual Operational Internal Audit plan. These objectives have been derived from agreed Council objectives and also cross referenced to the SRR. 212. It is important to note that local performance targets are also set out in in the quarterly update and monitoring report provided to the Audit and Scrutiny Committee on a frequent basis, these updates outline the targets set and the previous quarter performance. Oversee and Improve engagement Performance - Standard 12.3 213. The CIA must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies. • The CIA or an engagement supervisor must provide internal auditors with guidance throughout the engagement, verify work programs are complete, and confirm engagement working papers adequately support findings, conclusions, and recommendations. • To assume quality, the CIA must verify whether engagements are performed in conformance with the GIAS and the internal audit function’s methodologies. • To develop competencies, the CIA must provide internal auditors with feedback about their performance and opportunities for improvement. 214. The extent of supervision required depends on the maturity of the internal audit function, the proficiency about their performance and opportunities for improvement. 215. The CIA is responsible for supervising engagements, the engagement work is performed by the internal audit staff or by other service providers. Supervisory responsibilities may be delegated to appropriate and qualified individuals, but the CIA retains ultimate responsibility. 216. The CIA must ensure that evidence of supervision is documented and retained according to the internal audit function’s established methodologies. Implementation of these requirements within Argyll and Bute Council will be as follows:
Page 32
32 217. The work of Internal Audit is specified to deliver upon the requirements of the Annual Internal Audit Plan in accordance with the Charter and this Manual. 218. Internal audit activities are reviewed as part of each audit assignment prior to the issuing of reports. This is to ensure that the work continues to reflect the definitions per the Charter and the Manual. The Manual in this iteration has been specified to reflect the requirements of the GIAS effective from January 2025. 219. Internal auditors should: • only carry out services for which they have the necessary knowledge, skills and experience • perform services in accordance with the GIAS • continually improve the proficiency, effectiveness and quality of their services, for example through on going meetings and engagement with the CIA. 220. At an audit function level written policies and procedures, covering both technical and administrative matters are formally documented to guide audit staff in consistent conformance with GIAS. This is demonstrated by: • an annual assessment is undertaken, which is reported to the Committee, in order to determine the extent to which Internal Audit conforms to the GIAS • maintenance of the Charter, setting out the purpose, authority and responsibility of Internal Audit • maintenance of the Manual, providing guidance on working practices. 221. Audit engagement work conforms to written policies and procedures. This is demonstrated by: • all audit working papers being subject to formal review by the CIA • draft and final reports are checked and approved by the CIA and appropriate officers • this Manual setting out the various processes to ensure consistent conformance with GIAS. 222. Post-engagement client surveys to inform lessons learned, self-assessments, and other mechanisms to support continuous improvement are completed. These are issued at the end of each audit engagement with results acted upon and reported to the Committee. Performing Internal Audit Services – Domain V Principle 13 – Plan Engagements Effectively 223. Internal auditors plan each engagement using a systematic, disciplined approach. 224. The GIAS, along with methodologies established by the CIA, form the foundation of internal auditors’ systematic, disciplined approach to planning engagements. Internal auditors are responsible for effectively communicating at all stages of the engagement. 225. Engagement planning starts with understanding the initial expectations for the engagement and the reason the engagement was included in the internal audit plan. When planning engagements, internal auditors gather the information that enables them to understand the organisation and the
Page 33
33 activity under review and to assess the risks relevant to that activity. The engagement risk assessment allows internal auditors to identify and prioritize the risks to determine the engagement objectives and scope. Internal auditors also identify the criteria and resources needed to perform the engagement and develop an engagement work program, which describes the specific engagement steps to be performed. Engagement Communication - Standard 13.1 226. Internal auditors must communicate effectively throughout the engagement. 227. Internal auditors must communicate the objectives, scope, and timing of the engagement with management. Subsequent changes must be communicated with management timely. 228. At the end of the engagement, if internal auditors and management do not agree on the engagement results, internal auditors must discuss and try to reach a mutual understanding of the issue with management of the activity under review. If a mutual understanding cannot be reached, internal auditors must not be obliged to change any portion of the engagement results to allow both parties to express their positions regarding the context of the final engagement communication and the reasons for any differences of opinion regarding the engagement results. Implementation of these requirements within Argyll and Bute Council will be as follows: 229. The scope of the audit work should be established so that it is sufficient to satisfy the engagement’s objectives. The engagement scope should consider the following relevant areas of the Council (this should also consider relevant areas under the controls of outside parties): • systems • records • personnel • physical properties. 230. Where significant consulting opportunities have arisen during an assurance engagement, a specific written understanding as to the objectives, scope, respective responsibilities and other expectations should be developed and agreed with the CIA. 231. It is accepted that not all areas of a process will be reviewed at each audit, which might include geographical areas; the scope should be sufficient to satisfy the engagement objectives, but should also state, where appropriate, which areas are not covered. 232. For a consulting engagement, the scope of the engagement should be sufficient to address any agreed-upon objectives. If the internal auditors develop any reservations about the scope of a consulting engagement while undertaking that engagement, they are required to discuss those reservations with the relevant officer and the CIA to determine whether to continue with the engagement. 233. During consulting engagements, internal auditors are required to address the controls that are consistent with the objectives of those engagements.
Page 34
34 Engagement Risk Assessment - Standard 13.2 234. Internal auditors must develop an understanding of the activity under review to assess the relevant risks. For advisory services, a formal, documented risk assessment may not be necessary, depending on the agreement with stakeholders. 235. To develop an adequate understanding, internal auditors must identify and gather reliable, relevant and sufficient information regarding: • The organisation’s strategies, objectives, and risks relevant to the activity under review • The organisation's risk tolerance • The risk assessment supporting the internal audit plan • The governance, risk management, and other criteria that can be used to evaluate the effectiveness of those processes. 236. Internal auditors must review the gathered information to understand how processes are intended to operate. 237. Internal auditors must identify the risks to review by: • Identifying the potentially significant risks to the objectives of the activity under review • Considering specific risk related to fraud • Evaluating the significance of the risks and prioritizing them for review. 238. Internal auditors must identify the criteria that management uses to measure whether the activity is achieving its objectives. 239. When internal auditors have identified the relevant risks for an activity under review in past engagements, only a review and update of the previous engagement risk assessment is required. Implementation of these requirements within Argyll and Bute Council will be as follows: 240. The Annual Internal Audit Plan is based on a documented risk assessment process. The Internal Audit plan will be developed based on a prioritisation of those key risks facing the Council including input of the SMT and the Committee. The plan will be flexible in nature, can be updated to reflect the changing risks and priorities of the Council, and will take into account: • the Council’s risk registers and risk management framework • a balance of coverage across all operational areas (this constitutes the assurance nature of the plan ensuring an adequate level of internal audit review annually within each service) • experience gained from previous Internal Audit engagements • the impact of national issues (e.g. economic factors, the introduction of new legislation) • the impact of local issues (e.g. Corporate Objectives) • periodic review of core financial and operational systems • the available audit resource and skills • staff development and training • time needed for the management of the internal audit function • contingency set aside for consultancy, reviews or investigations • liaison with other assurance providers such as the External Auditor and other scrutiny bodies.
Page 35
35 Engagement Objectives and Scope - Standard 13.3 241. Internal auditors must establish and document the objectives and scope of each engagement. 242. The engagement objectives must articulate the purpose of the engagement and describe the specific goals to be achieved, including those mandated by laws and/or regulations. 243. The scope must establish the engagement’s focus and boundaries by specifying the activities, locations, processes, systems, components, time period to be covered in the engagement, and other elements to be reviewed, and be sufficient to achieve the engagement objectives. 244. Internal auditors must consider whether the engagement is intended to provide assurance or advisory services because stakeholders expectations and the requirements of the GIAS differ depending on the type of engagement. 245. Scope limitations must be discussed with management when identified, with a goal of achieving resolutions. Scope limitations are assurance engagement conditions, such as resource constraints or restrictions on access to personnel, facilities, data, and information, that prevent internal auditors from performing the work as expected in the audit engagement work program. 246. If resolutions cannot be achieved with management, the CIA must elevate the scope limitation issue to the Board according to an established methodology. 247. Internal auditors must have the flexibility to make changes to the engagement objectives and scope when the work identifies the need to do so as the engagement progresses. 248. The CIA must approve the engagement objectives and the scope and any changes that occur during the engagement. Implementation of these requirements within Argyll and Bute Council will be as follows: 249. The scope of the audit work should be established so that it is sufficient to satisfy the engagement’s objectives. The engagement scope should consider the following relevant areas of the Council (this should also consider relevant areas under the controls of outside parties): • systems • records • personnel • physical properties. 250. Where significant consulting opportunities have arisen during an assurance engagement, a specific written understanding as to the objectives, scope, respective responsibilities and other expectations should be developed and agreed with the CIA. 251. In the event that the scope cannot be agreed with the management or that there are concerns over any limitations, resource constraints or restrictions, such matters will be raised by the CIA with the most appropriate senior officer within the Council. If at this stage such matters cannot be resolved this will be reported to the Audit and Scrutiny Committee.
Page 36
36 252. Internal auditors will have the flexibility to make changes to the engagement objectives and scope when audit work identifies the need to do so as the engagement progresses. Such changes must be discussed with the CIA during the audit engagement. Evaluation Criteria - Standard 13.4 253. Internal auditors must identify the most relevant criteria to be used to evaluate the aspects of the activity under review as defined in the engagement objectives and scope. For advisory services the identification of evaluation criteria may not be necessary, depending on the agreement with relevant stakeholders. 254. Internal auditors must assess the extent to which the Board and senior management have established adequate criteria to determine whether the activity under review has accomplished its objectives and goals. If such criteria are adequate, internal auditors must use them for the evaluation. If the criteria are inadequate, internal auditors must identify appropriate criteria through discussion with the Board and/or senior management. Implementation of these requirements within Argyll and Bute Council will be as follows: 255. Internal auditors as part of the information gathering process and planning of the audit engagement determine the criteria to evaluate the effectiveness and efficiency of the governance, risk management and control processes of the area under review. 256. Internal auditors will consider the necessary criteria for identifying a difference between the desired state and the condition which represents potential findings. This may include but not limited to the following criteria: • Internal (policies, procedures, key performance indicators, targets) • External (laws, regulations and contractual obligations) • Authoritative practices (frameworks, standards, guidance, benchmarks) • Established organisational practices Engagement Resources - Standard 13.5 257. When planning an engagement, internal auditors must identify the types and quantity of resources necessary to achieve the engagement objectives. 258. Internal auditors must consider: • The nature and complexity of the engagement • The time frame within which the engagement is to be completed • Whether the available financial, human, and technological resources are appropriate and sufficient to achieve the engagement objectives. 259. If the available resources are inappropriate or insufficient, internal auditors must discuss the concerns with the CIA to obtain the resources. Implementation of these requirements within Argyll and Bute Council will be as follows: 260. The CIPFA Local Government Application note states that ‘No formula exists that can be applied to determine internal audit coverage needs. However, as a guide, the minimum level of coverage is
Page 37
37 that required to give an annual evidence-based opinion. Local factors within each organisation will determine this minimum level of coverage’. 261. It is the CIA’s responsibility to ensure that resourcing arrangements are in place to deliver the annual risk based internal audit plan and that those resources are flexible enough to cope with special requests. Where applicable the CIA may seek additional input from external providers. 262. The internal audit plan will document the budgeted resource requirements for the audit year. It will also include a contingency to address unplanned work. Should circumstances arise during the year that suggests that available resource levels will fall or appear to be falling below the level required to deliver the plan, the CIA will communicate the impact of resource limitations and significant interim changes to the Committee. Work Program - Standard 13.6 263. Internal auditors must develop and document an engagement work program to achieve the engagement objectives. 264. The engagement work program must be based on the information obtained during engagement planning, including, when applicable, the results of the engagement risk assessment. 265. The engagement work program must identify: • Criteria to be used to evaluate each objective • Tasks to achieve the engagement objectives • Methodologies, including the analytical procedures to be used, and tools to perform the tasks • Internal auditors assigned to perform each task. 266. The CIA must review and approve the engagement work program, before its implemented and promptly when any subsequent changes are made. Implementation of these requirements within Argyll and Bute Council will be as follows: 267. The CIA has developed a template work programme which provides a clear link between the programme and the agreed terms of reference and Internal Auditors should use this template for all assignments. The template demonstrates how the work performed meets the agreed engagement objectives. 268. The work programme should be created by the internal audit team member assigned the audit, in discussion with the CIA, and include procedures for identifying, analysing, evaluating and documenting information. Work programmes for consulting engagements may vary in form and content depending on the nature of the engagement. This will require the approval of the CIA. 269. Work programmes must be approved by the CIA prior to implementation for each engagement and amended as necessary. Principle 14 – Conduct Engagement Work 270. Internal auditors implement the engagement work program to achieve the engagement objectives.
Page 38
38 271. To implement the engagement work program, internal auditors gather information and perform analysis and evaluations to produce evidence. These steps enable internal auditors to: • Provide assurance and identify potential findings • Determine the causes, effects, and significance of the findings • Develop recommendations and/or collaborate with management to develop action plans • Develop conclusions. Gathering Information for Analyses and Evaluation - Standard 14.1 272. To perform analysis and evaluations, internal auditors must gather information that is: • Relevant - consistent with engagement objectives, within the scope of the engagement, and contributes to the development of engagement results • Reliable – factual and current. Internal auditors use professional scepticism to evaluate whether information is reliable. Reliability is strengthened when the information is: o Obtained directly by an internal auditor or from an independent source. o Corroborated. o Gathered from a system with effective governance, risk management, and control processes. • Sufficient – when it enables internal auditors to perform analyses and complete evaluations and can enable a prudent, informed, and competent person to repeat the engagement work program and reach the same conclusions as the internal auditor. 273. Internal auditors must evaluate whether the information is relevant and reliable and whether it is sufficient such that analyses provide a reasonable basis upon which to formulate potential engagement findings and conclusions. 274. Internal auditors must determine whether to gather information for analyses and evaluation when evidence is not relevant, reliable, or sufficient to support engagement findings. If relevant evidence cannot be obtained, internal auditors must determine whether to identify that as a finding. Implementation of these requirements within Argyll and Bute Council will be as follows: 275. Internal auditors are required to identify sufficient, reliable, relevant and useful information to achieve each engagement’s objectives. 276. Sufficient information is factual, adequate and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Reliable information is the best attainable information through the use of appropriate engagement techniques. Relevant information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful information helps the organisation meet its goals. 277. In the event that such evidence cannot be obtained or deemed reliable, an appropriate finding or observation will be communicated within the report to management. Analyses and Potential Engagement Findings - Standard 14.2 278. Internal auditors must analyse relevant, reliable, and sufficient information to develop potential engagement findings. For advisory services, gathering evidence to develop findings may not be necessary, depending on the agreement with relevant stakeholders.
Page 39
39 279. Internal auditors must analyse information to determine whether there is a difference between the evaluation criteria and the existing state of the activity under review, known as the ‘condition’. 280. Internal auditors must determine the condition by using information and evidence gathered during the engagement. 281. A difference between the criteria and the condition indicates a potential engagement finding that must be noted and further evaluated. If initial analyses do not provide sufficient evidence to support a potential engagement finding, internal auditors must exercise due professional care to determine whether additional analyses are required. 282. If additional analysis is required, the work program must be adjusted accordingly and approved by the CIA. 283. If internal auditors determine that no additional analysis is required and there is no difference between the criteria and the condition, the internal auditors must provide assurance in the engagement conclusion regarding the effectiveness of the activity’s governance, risk management, and control processes. Implementation of these requirements within Argyll and Bute Council will be as follows: 284. Internal auditors must consider the information that is available in terms of achieving the objectives of the audit, in doing so, they may need to perform appropriate analysis if information using a variety of options, including but not limited to, ratio, trend, regression analysis, financial comparison, benchmarking. It is important for the internal auditor to assess what would be appropriate within each specific review and what would be the most helpful in achieving the objectives of the review. 285. There may also be the need for additional testing where concerns have been identified through initial testing results in order to identify unacceptable errors which will need to be reported to management in the final report. Evaluation of Findings - Standard 14.3 286. Internal auditors must evaluate each potential engagement finding to determine its significance. When evaluating potential engagement findings, internal auditors must collaborate with management to identify the root causes when possible, determine the potential effects, and evaluate the significance of the issue. 287. To determine the significance of the risk, internal auditors must consider the likelihood of the risk occurring and the impact the risk may have on the organisation’s governance, risk management, or control processes. 288. If internal auditors determine that the organisation is exposed to a significant risk, it must be documented and communicated as a finding. 289. Internal auditors must determine whether to report other risks as findings, based on the circumstances and established methodologies.
Page 40
40 290. Internal auditors must prioritize each engagement finding based on its significance, using methodologies established by the CIA. Implementation of these requirements within Argyll and Bute Council will be as follows: 291. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. Recommendations and Action Plans - Standard 14.4 292. Internal auditors must determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on actions to: • Resolve the differences between the established criteria and the existing condition • Mitigate identified risks to an acceptable level • Address the root cause of the finding • Enhance or improve the activity under review. 293. When developing recommendations, internal auditors must discuss the recommendations with management of the activity under review. 294. If internal auditors and management disagree about the engagement recommendations and/or action plans, internal auditors must follow an established methodology to allow both parties to express their positions and rationale and to determine a resolution. Implementation of these requirements within Argyll and Bute Council will be as follows: 295. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. Any deviation from the template report requires approval by the CIA. 296. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy. This will generally be carried out at a clearance meeting and a template has been created to facilitate and document that meeting. 297. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 298. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 299. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety this disagreement will be reported to the Committee as and when the report is presented.
Page 41
41 Engagement Conclusions - Standard 14.5 300. Internal auditors must develop an engagement conclusion that summarises the engagement results relative to the engagement objectives and management’s objectives. The engagement conclusion must summarize the internal auditors’ professional judgment about the overall significance of the aggregated engagement findings. 301. Assurance engagement conclusions must include the internal auditors’ judgement regarding the effectiveness of the governance, risk management and/or control processes are effective. Implementation of these requirements within Argyll and Bute Council will be as follows: 302. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. 303. When performing audits, internal auditors are required to base their conclusions and engagement results on appropriate analysis and evaluation whilst remaining alert to the possibility of: • intentional or unintentional wrongdoing • errors and omissions • poor value for money • failure to comply with Council policy • conflicts of interest. Engagement Documentation - Standard 14.6 304. Internal auditors must document information and evidence to support the engagement results. The analysis, evaluations, and supporting information relevant to an engagement must be documented such that an informed, prudent internal auditor, or similarly informed and competent person, could repeat the work and derive the same engagement results. 305. Internal auditors and the engagement supervisor must review the engagement documentation for accuracy, relevance, and completeness. The CIA must review and approve the engagement documentation. Internal auditors must retain engagement documentation according to relevant laws and/or regulations as well as policies and procedures of the internal audit function and the organization. Implementation of these requirements within Argyll and Bute Council will be as follows: 306. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. 307. Records management must be consistent with the Council’s overall document retention policy, which is in turn consistent with the requirements of the Information Commissioner’s Office. Internal Audit record keeping must also be consistent with the specific requirements of the area
Page 42
42 audited, for example EU audits require documents to be kept for 7 years after the last payment has been made. 308. Electronic engagement records are kept in a restricted folder and on Sharepoint. ICT are responsible for the security controls, and the CIA is responsible for specifying who should have access to this. 309. The CIA shall obtain the approval of senior management and/or legal counsel as appropriate before releasing any engagement records to external parties. Principle 15 – Communicate Engagement Results and Monitor Action Plans 310. Internal auditors communicate the engagement results to the appropriate parties and monitor management’s progress toward the implementation of recommendations or action plans. 311. Internal auditors are responsible for issuing a final communication after completing the engagement and communicating the engagement of the activity under review to confirm that action plans are implemented. Final Engagement Communication - Standard 15.1 312. For each engagement, internal auditors must develop a final communication that includes the engagement’s objectives, scope, recommendations and/or action plans if applicable, and conclusions. 313. The final communication for assurance engagements also must include: • The findings and their significance and prioritisation • An explanation of scope limitations, if any • A conclusion regarding the effectiveness of the governance, risk management and control processes of the activity reviewed. 314. The final communication must specify the individuals responsible for addressing the findings and the planned date by which the final communication should be completed. 315. When Internal auditors become aware that management has initiated or completed actions to address a finding before the final communication, the actions must be acknowledged in the communication. 316. The final communication must be accurate, objective, clear, concise. Constructive, complete, and timely, as described in Standard 11.2 Effective Communication. 317. Internal auditors must ensure the final communication is reviewed and approved by the CIA before it is issued. 318. The CIA must disseminate the final communication to parties who can ensure that the results are given consideration.
Page 43
43 319. If the engagement is not conducted in conformance with the GIAS. The final engagement communication must disclose the following details about the non-conformance: • Standard(s) with which conformance was not achieved • Reasons(s) for non-conformance. • Impact of non-conformance on the engagement findings and conclusions. Implementation of these requirements within Argyll and Bute Council will be as follows: 320. Communicating the results of our internal audit work is a crucial aspect of the audit process and is the key link to our stakeholders including the SMT, Heads of Service, Elected Members, the Committee and (where appropriate) the public. 321. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. Any deviation from the template report requires approval by the CIA. 322. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy. This will generally be carried out at a clearance meeting and a template has been created to facilitate and document that meeting. 323. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 324. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 325. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety this disagreement will be reported to the Committee as and when the report is presented. 326. In completing audit activities, auditors are required to include and disclose all material facts identified as part of their audit work and subsequent reports which, if not disclosed, could distort their reports or conceal unlawful practice. Such disclosures should be made with reference to confidentiality requirements or other considerations that may preclude the release of information into the public domain which are primarily outlined in Schedule 7A Exempt Information – Local Government (Scotland) Act 1973 or as amended. 327. The work of Internal Audit should always seek to ensure that communications are accurate, objective, clear, concise, constructive, complete, and timely. 328. It is the CIA’s responsibility to ensure that where a final report contains a significant error or omission, subsequent changes, revisions or corrections are communicated to all parties who received the original communication. 329. Where any non-conformance with the GIAS has impacted on a specific engagement, the communication of the results should include the following disclosures:
Page 44
44 • the principle(s) or rule(s) of conduct of the GIAS with which full conformance was not achieved • the reason(s) for non-conformance • the impact of non-conformance on the engagement and the engagement results. 330. The CIA is responsible for determining the circulation of audit reports within the Council. This circulation should be mindful of confidentiality or the possibility of other legislative requirements. Standard practice is for the report to be issued to the: • Chief Executive • relevant Executive Director • relevant Head of Service • Head of Financial Services • SMT Admin (for inclusion in SMT meeting) • key audit contact • external audit • the Committee 331. The CIA shall determine whether there is any specific reason for the distribution list to be amended for any specific report. All audit reports are submitted in their entirety to the Committee which, through the transparent provision of committee papers, makes them public documents. In the event that the report contains sensitive information they may be restricted however this decision will only be taken in consultation with senior management and legal counsel as appropriate. Confirming the Implementation of Recommendations or Action Plans - Standard 15.2 332. Internal auditors must confirm that management has implemented internal auditors’ recommendations or management’s action plans following an established methodology, which includes: • Inquiring about progress on implementation • Performing follow-up assessments using a risk-based approach • Updating the status of management’s actions in a tracking system. Implementation of these requirements within Argyll and Bute Council will be as follows: 333. Internal Audit are responsible for following up on agreed action plans to ensure those actions are properly implemented. On a quarterly basis services are contacted and asked to provide an update on progress against all open action plan points. This is reported to the SMT on a quarterly basis and as a standard agenda item to the Committee. Where a service reports an action has been closed Internal Audit ask for evidence to support that status. All action plan points will remain open until appropriate action is demonstrably taken by management or the risk of no action is formally accepted.