Internal Audit - Global Internal Audit Standards and Application Note for UK Public Sector
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT – GLOBAL INTERNAL AUDIT STANDARDS AND APPLICATION NOTE FOR UK PUBLIC SECTOR 1. INTRODUCTION 1.1 The objective of the report is to provide the Audit and Scrutiny Committee (the Committee) with an update arising from the introduction of new Global Internal Audit Standards (GIAS) and the supplementary Application Note: GIAS in the UK Public Sector (Application Note) issued by the Chartered institute of Public Finance and Accountancy (Cipfa). The Application Note will complement the standards that will apply to the practice of internal audit from the perspective of the head of internal audit. In addition, there may be implications for the Audit and Scrutiny Committee in their oversight role as those charged with governance and responsibility to discharge these duties taking cognisance of such changes required in order to comply. 1.2 The Local Authority Accounts (Scotland) Regulation 2014 makes provision for Internal Audit to be a statutory service and a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing. 1.3 The current Public Sector Internal Audit Standards (PSIAS) will remain in force until 31 March 2025. 1.4 The new GIAS and Application Note relating to UK Local Government will come into effect on 1st April 2025. 2. RECOMMENDATIONS The Audit and Scrutiny Committee is asked to: 2.1 Note the requirements of the new GIAS Standards as outlined in para 3.3 of the report and also those contained within the Application Note which require the Council’s Internal Audit section to comply with effect from the 1 April 2025. 2.2 Note the gaps outlined in paragraph 3.5 which require to be addressed in order to comply and agree the action plan to address these requirements of the Standards. 2.3 . Note the additional duties expected of the Audit and Scrutiny Committee in their roles as ‘those charged with governance duties’. 3 DETAIL 3.1 A number of key elements of the new GIAS continues to retain existing areas of applicability in relation to the operation of Internal Audit, particularly how it performs it work, is managed and the ethical and professional requirements
Page 2
expected of those working within the profession. However, these are laid out differently and also include a number of changes which promote further requirements within the profession. Specific areas or as it is called within the GIAS ‘Domains’ provide a worldwide set of Standards, however, the implementation of these in relation to some specific areas need to be considered specifically to the way they may relate in the public sector. The GIAS is helpful in many elements in a global and ‘broadbrush’ way which whilst helpful, there is a further need to set out how this is to be interpreted in the context and form that is suitable for internal audit practice in the UK public sector. 3.2 The process of review and how the implications of these GIAS are best integrated into the UK are considered through the authority of the ‘Relevant Internal Audit Standard Setters’ (RIASS). The RIASS have determined that the Institute of Internal Auditors’ new Global Internal Audit Standards (GIAS) will apply from 1 April 2025, subject to interpretations and requirements for the UK public sector which are set out in an Application Note as the internal audit standard setter for UK local government. CIPFA has consulted on the Application Note and have subsequently issued it in final form. The Application Note complements the Standards which apply to the practice of internal audit. 3.3 The GIAS consists of five overarching areas consistent with the operation of internal audit, which are called ‘domains’ and each domain has associated attached principles relating to specific requirements of practice, there is a total of 15 ‘Principles’ across these five domains. I. Purpose of Internal Auditing II. Ethics & Professionalism III. Governing the Internal Audit Function IV. Managing the Internal Audit Function V. Performing Internal Audit Services
Page 3
GIAS do not add any UK public sector requirements in relation to governance but to achieve conformance the internal audit function must demonstrate that there are adequate and appropriate arrangements for its governance. Domain III of the GIAS sets out baseline ‘essential conditions’ for governance, but these require adjustment to reflect the operation of governance within the UK local government sector. The CIPFA Application Note sets out the basis for suitably adjusted essential conditions, and when the code is applied, together with the Application Note, the objectives of the GIAS conditions will be achieved. The Application Note will apply to all local government bodies whether their internal audit function is delivered in-house, through a shared service, or outsourced. Approach to the assessment of any gap in complying with GIAS, UK Public Sector Application Note and Code of Practice 3.4 As outlined, there are a significant number of requirements which are taken over from the previous Standards and we are able to demonstrate compliance with, albeit having to be presented and documented in a different way within the new GIAS. Notwithstanding, there are six specific areas where there needs to be further work in terms of how we approach our full compliance but also demonstrate it effectively, particularly when it comes to our annual and five-year reviews. A good way of identifying these areas to address is through an initial ‘gap analysis’. It should be noted that it is intended that a document to support a thorough benchmark will not be available until late autumn, as advised by CIPFA, however, when this is issued, this definitive assessment platform will form the basis of a further assessment which will be undertaken. The information currently available provides a reasonable basis to identify many of the issues that need to be dealt with and once the full assessment tool is available, this will be used to identify if any other minor elements need to be addressed. 3.5 The ‘Gap Analysis’ has identified the following areas which will need to be addressed in order to demonstrate compliance with the GIAS and Application Note, together with who will be responsible for taking these actions forward and the timeline which these gaps will be addressed, these are summarised in the table below.
Page 4
3.6 Action Required Officer(s)/Member(s) Responsible and Completion Date The Internal Audit Annual report with effect from financial year 2025/26 will require to include a statement on compliance with the GIAS and Application Note. (Where compliance is not achieved this should be outlined along with the reasons and proposed action plan to address any deficiency) Chief Internal Auditor Internal Audit Annual Report 2025/26 – June 2026 (The 2025/26 financial year will be the first year of applicability). The Internal Audit Charter will require to be updated to reflect the changes contained in the GIAS and Application Note– “the audit committee should be satisfied that it covers the governance arrangements for internal audit. It must include the mandate derived from the regulations, plus any additional agreed mandate, and include internal audit’s reporting line to the audit committee. The charter should include the administrative reporting arrangements for internal audit and the chief audit executive”. Chief Internal Auditor Updated Charter and Manual March 2025 (As these documents are routinely assessed on an annual basis, further updates will be included, where required and applicable in future iterations), The Chief Audit Executive must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation….” Chief Internal Auditor New Internal Audit Strategy 2025-28 to be considered by the Audit and Scrutiny Committee. April 2025 The Audit Committee must review the safeguards of internal audit’s independence at least annually including any concerns about Chief Internal Auditor Proposed action – A formal statement will be contained within the Internal Audit Annual Report outlining the position of safeguarding Internal Audit independence
Page 5
independence from the Chief Internal auditor. and whether there have been any restrictions or concerns. (This will allow the Audit and Scrutiny Committee to review the statement within the Annual Report and seek any explanations as is required on the current safeguards and/or the opinion from the CIA). June 2025 The Audit Committee and senior management must engage with the Chief Internal Auditor to review whether internal audit’s financial, human and technological resources are sufficient to meet internal audit’s mandate as set out in the regulations and achieve conformance with GIAS (UK public sector). Chief Internal Auditor, Head of Finance and Audit and Scrutiny Committee Proposed action – The Chief Internal Auditor will outline each year in the Operational Audit Plan, whether in his opinion, there are sufficient resources to enable the plan to be fulfilled. The Audit and Scrutiny Committee will review the plan and where appropriate seek explanation if there are any concerns raised by the Chief Internal Auditor in relation to the resources provided or available to undertake the work contained within the plan. (The CIA will continue to make a provision within the plan for contingency/unplanned work or events as is prudent) March 2025 and annually thereafter (The determination of resources and budgetary requirements are dealt with through each departmental resource identification process and which Internal Audit participates). Where there is disagreement about the management of risks or agreed audit actions between internal audit and senior management, the Audit Committee must review and make their recommendation to either management or those charged with governance Chief Internal Auditor Proposed action – The Chief Internal Auditor would submit the Internal Audit report highlighting any area(s) and recommendation(s) which could not be agreed along with the management comments in such an event. (This will be specifically referenced within the Internal Audit Manual to reflect this process) March 2025
Page 6
3.7 The current PSIAS will be effective until 31 March 2025 and will be applicable to the preparation and reporting which will be contained within the Internal Audit Annual Report and opinion, presented to the Committee in June 2025. Once the Application Note – Assessment Tool becomes available this will allow a further detailed review to be undertaken and, if necessary, action taken to address any residual identified gaps, deviation or non-compliance. 4. CONCLUSION 4.1 4.2 The Council’s Internal Audit service must comply with the new Standards, Application Note and any supplementary guidance in relation to how these Standards should be implemented in the public sector in the United Kingdom. The Audit and Scrutiny Committee have overview in that role and there are good and open communications lines in place that will continue to support such relationship between the Committee, CIA and senior management. The CIA through discussions with the Chair and Vice/Chair and overview of the Committee require to monitor progress in meeting any areas of change required. 5 IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – By having an Internal audit function which complies with regulatory and global standards helps to demonstrate a good foundation to support governance and may reduce risk 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor (01546 604108)