ABC Internal Audit Manual (March 2024)
Argyll and Bute Council · 14 March 2024
Back to Audit and Scrutiny Committee — 14 March 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Manual March 2024
Page 2
2 Contents Introduction .................................................................................................................................................. 4 Internal Audit Mission (PSIAS Section 3) ..................................................................................................... 4 Definition of Internal Auditing (PSIAS Section 4) ........................................................................................ 4 Ethics (PSIAS Section 6) ................................................................................................................................ 4 Overview .................................................................................................................................................... 4 Applicability and Enforcement .................................................................................................................. 4 Relevant Codes .......................................................................................................................................... 5 Integrity ..................................................................................................................................................... 5 Objectivity ................................................................................................................................................. 5 Confidentiality ........................................................................................................................................... 5 Competency............................................................................................................................................... 5 Principles of Public Life .............................................................................................................................. 6 PSIAS Attributes ............................................................................................................................................ 6 Internal Audit Charter (PSIAS 1000 - 1120) ............................................................................................... 6 Proficiency (PSIAS 1210) ............................................................................................................................ 6 Due Professional Care (PSIAS 1220) .......................................................................................................... 7 Quality Assurance and Improvement Programme (PSIAS 1300) .............................................................. 7 Requirements of the Quality Assurance and Improvement Programme (PSIAS 1310) ............................ 8 Internal Assessments (PSIAS 1311) ........................................................................................................... 8 External Assessments (PSIAS 1312) ........................................................................................................... 8 Reporting on the Quality Assurance and Improvement Programme (PSIAS 1320) .................................. 9 International Standards for the Professional Practice of Internal Auditing’ (PSIAS 1321)........................ 9 Disclosure of Non-conformance (PSIAS 1322) .......................................................................................... 9 Performance.................................................................................................................................................. 9 Managing the Internal Audit Activity (PSIAS 2000) ................................................................................... 9 Planning (PSIAS 2010) ................................................................................................................................ 9 Communication and Approval (PSIAS 2020) ........................................................................................... 10 Resource Management (PSIAS 2030) ...................................................................................................... 10 Policies and Procedures (PSIAS 2040) ..................................................................................................... 10 Coordination and Reliance (PSIAS 2050) ................................................................................................. 10 Reporting to Senior Management and the Board (PSIAS 2060).............................................................. 11 External Provider & Organisational Responsibility for Internal Auditing (PSIAS 2070) .......................... 11 Nature of the Work ..................................................................................................................................... 11 Governance (PSIAS 2110) ........................................................................................................................ 11
Page 3
3 Risk Management (PSIAS 2120) .............................................................................................................. 11 Control (PSIAS 2130)................................................................................................................................ 12 Engagement Planning ................................................................................................................................. 12 Engagement Objectives (PSIAS 2210) ..................................................................................................... 12 Engagement Scope (PSIAS 2220) ............................................................................................................. 13 Engagement Resource Allocation (PSIAS 2230) ...................................................................................... 13 Engagement Work Programme (PSIAS 2240) .......................................................................................... 13 Performing the Engagement ...................................................................................................................... 14 Identifying Information (PSIAS 2310) ...................................................................................................... 14 Analysis and Evaluation (PSIAS 2320) ...................................................................................................... 14 Documenting Information (PSIAS 2330).................................................................................................. 14 Engagement Supervision (PSIAS 2340) .................................................................................................... 14 Communicating Results .............................................................................................................................. 14 Criteria for Communicating (PSIAS 2410) ................................................................................................ 15 Quality of Communications (PSIAS 2420) ............................................................................................... 15 Errors and Omissions (PSIAS 2421) ......................................................................................................... 15 Use of ‘Conducted in Conformance with the International Standards for the Professional Practice of Internal Auditing’ (PSIAS 2430) ............................................................................................................... 15 Engagement Disclosure of Non-Conformance (PSIAS 2431) ................................................................... 15 Disseminating Results (PSIAS 2440) ........................................................................................................ 16 Overall Opinion (PSIAS 2450) .................................................................................................................. 16 Monitoring Progress (PSIAS 2500) ............................................................................................................. 16
Page 4
4 Introduction 1. The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Public Sector Internal Audit Standards (PSIAS), which came into effect in April 2013, and were updated in March 2017. 2. This Internal Audit Manual (the Manual) has been created to provide guidance to the Internal Audit section of Argyll and Bute Council (the Council) on the administration of the department and audit approach to be adopted. The contents are guided by the requirement of PSIAS with the key sections cross referenced to the appropriate section in PSIAS. Internal Audit Mission (PSIAS Section 3) 3. It is Internal Audit’s mission to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. Definition of Internal Auditing (PSIAS Section 4) 4. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve the Council’s operations. It helps the Council accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Ethics (PSIAS Section 6) Overview 5. The purpose of a ‘Code of Ethics’ is to promote an ethical culture within the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, governance and control. A ‘Code of Ethics’ extends beyond the definition of internal auditing to include two essential components: • principles that are relevant to the profession and practice of internal auditing • rules of conduct that describe behaviour norms expected of internal auditors. Applicability and Enforcement 6. A ‘Code of Ethics’ applies to all of those who are commissioned to provide internal audit services to the Council. Suspected or known breaches of the ‘Code of Ethics’ should be referred to at least one of the following, as considered appropriate: • Chief Internal Auditor (CIA) • Executive Director (Kirsty Flanagan) (Section 95 Officer) • Executive Director (Douglas Hendry) (Monitoring Officer) • Audit and Scrutiny Committee (the Committee). 7. The fact that a particular piece of ‘behaviour’ which has been identified as being possibly inappropriate is not specifically covered by, or mentioned within, the Council’s own ‘Code of Conduct’, does not necessarily prevent it from being unacceptable, discreditable or indeed unprofessional.
Page 5
5 8. For members of the Chartered Institute of Internal Auditors, breaches of the ‘Code of Ethics’ will be evaluated and administered in line with the Institute’s disciplinary procedures. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. Such procedures are without prejudice to the Council’s own disciplinary procedures. All members of the internal audit team, on an annual basis, self-assess their compliance with ethical principles and relevant Argyll and Bute Council policies by completing a Fit and Proper form. This is submitted to the CIA. Relevant Codes 9. Qualified internal auditors could be members of one or more of the following institutions: Chartered Institute of Public Finance & Accountancy (CIPFA), the Chartered Institute of Management Accountants (CIMA), the Chartered Institute of Internal Auditors (IIA) and the Association of Chartered Certified Accountants (ACCA). Each of these bodies have their own Code of Ethics which members are expected to comply with. Integrity 10. Internal auditors should: • perform their work with honesty, diligence and responsibility • observe the law and make disclosures expected by the law and the profession • not knowingly be a party to any illegal activity nor engage in acts that are discreditable to the profession of internal auditing or to the organisation • respect and contribute to the legitimate and ethical objectives of the Council. Objectivity 11. Internal auditors should: • not take part in any activity or relationship that may impair or be presumed to impair their unbiased assessment • not accept anything that may impair or be presumed to impair their professional judgement • disclose all material facts known to them that, if not disclosed, may distort the reporting or activities under review. Confidentiality 12. Internal auditors should: • act prudently when using information acquired in the course of their duties and protect that information • not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the Council. Competency 13. Internal auditors should: • only carry out services for which they have the necessary knowledge, skills and experience • perform services in accordance with the International Standards for the Professional Practice of Internal Auditing (as applied in the PSIAS) • continually improve the proficiency and effectiveness and quality of their services, for example through on going meetings and engagement with the CIA.
Page 6
6 Principles of Public Life 14. In all dealings, Internal Audit will adhere to Nolan’s seven principles of public life as set out in Exhibit 1. Exhibit 1– Nolan’s Seven Principles of Public life Principle Description Selflessness Holders of public office should take decisions solely in terms of the public interest. Integrity Holders of public office should not place themselves under any financial or other obligation to outside individuals or organisations that might influence them in the performance of their official duties. They should not act or take decisions in order to gain financial or other material benefits for themselves, their family, or their friends. Objectivity In carrying out public business, including making public appointments, awarding contracts, or recommending individuals for rewards and benefits, holders of public office should make choices impartially, fairly and on merit, using the best evidence and without discrimination or bias. Accountability Holders of public office are accountable for their decisions and actions to the public and must submit themselves to whatever scrutiny is appropriate to their office. Openness Holders of public office should be as open as possible about all the decisions and actions that they take. They should give reasons for their decisions and restrict information only when the wider public interest clearly demands. Honesty Holders of public office have a duty to declare any private interests relating to their public duties and to take steps to resolve any conflicts arising in a way that protects the public interest. Leadership Holders of public office should promote and support these principles by leadership and example. PSIAS Attributes Internal Audit Charter (PSIAS 1000 - 1120) 15. The Internal Audit Charter (the Charter), which has been agreed by the Committee, and is subject to annual review and approval, provides the required information to comply with the PSIAS attributes listed in Exhibit 2. As such this detail is not repeated in the Manual. The Manual will cover all other requirements of PSIAS. Exhibit 2– PSIAS Attributes Detailed in the Internal Audit Charter PSIAS Reference Attribute PSIAS 1000 Purpose, Authority & Responsibility PSIAS 1100 Independence & Objectivity PSIAS 1110 Organisational Independence PSIAS 1120 Individual Objectivity Proficiency (PSIAS 1210) 16. The Internal Audit team will work with proficiency and due professional care. The CIA shall be a CCAB accountant or CMIIA internal auditor with suitable internal audit experience. 17. The CIA is responsible for recruiting appropriate internal audit staff in accordance with the Council’s recruitment processes. As part of the role the CIA shall:
Page 7
7 • ensure that internal audit collectively possess or obtain the skills, knowledge and other competencies required to perform its responsibilities • obtain competent advice and assistance where internal audit does not possess the skills, knowledge and other competencies required to perform its responsibilities • ensure that internal auditors have sufficient knowledge to evaluate the risk of fraud and anti- fraud arrangements in the organisation • ensure that internal auditors have sufficient knowledge of key information technology risks and controls • ensure that internal auditors have sufficient knowledge of the appropriate computer-assisted audit techniques that are available to them to perform their work. Due Professional Care (PSIAS 1220) 18. In completing planning activities and subsequent audit work internal auditors shall consider the: • extent of work needed to achieve the engagement’s objectives • relative complexity, materiality or significance of matters to which assurance procedures are applied • adequacy and effectiveness of governance, risk management and control processes • probability of significant errors, fraud, or non-compliance • cost of assurance in relation to potential benefits. 19. In addition internal auditors exercise due professional care during a consulting engagement by considering the: • needs and expectations of clients, including the nature, timing and communication of engagement results • relative complexity and extent of work needed to achieve the engagement’s objectives • cost of the consulting engagement in relation to potential benefits. 20. The CIA will ensure that regular conversations take place about performance, behaviours and career/development aspirations in line with the Council’s -approach to the PRD process, this will be undertaken on an annual basis. Quality Assurance and Improvement Programme (PSIAS 1300) 21. The Institute of Internal Auditors (IIA) Practice Guide “Quality Assurance and Improvement Programme” (QAIP) defines a quality assurance and improvement programme as: “An ongoing and periodic assessment of the entire spectrum of audit and consulting work performed by the internal audit activity. These ongoing and periodic assessments are composed of rigorous, comprehensive processes; continuous supervision and testing of internal audit and consulting work; and periodic validations of conformance with the Definition of Internal Auditing, the Code of Ethics, and the Standards. This also includes ongoing measurement and analyses of performance metrics (e.g. internal audit plan accomplishment, recommendations accepted and customer satisfaction). If the assessments’ results indicate areas for improvement by the internal audit activity, the chief audit executive will implement the improvements through the QAIP.”
Page 8
8 Requirements of the Quality Assurance and Improvement Programme (PSIAS 1310) 22. In accordance with the requirements of PSIAS the CIA has developed and maintains a QAIP that covers all aspects of the internal audit activity and enables conformance with all aspects of the PSIAS to be evaluated. 23. The QAIP assesses the efficiency and effectiveness of the internal audit activity and identifies opportunities for improvement. This assessment takes into account quality improvement from both internal and external assessments. Internal Assessments (PSIAS 1311) 24. At an audit activity level written policies and procedures, covering both technical and administrative matters are formally documented to guide audit staff in consistent conformance with PSIAS and the Code of Ethics. This is demonstrated by: • an annual assessment is undertaken, which is reported to the Committee, in order to determine the extent to which Internal Audit conforms to the Standards • maintenance of the Charter, setting out the purpose, authority and responsibility of Internal Audit • maintenance of the Manual, providing guidance on working practices. 25. Audit work conforms to written policies and procedures. This is demonstrated by: • all audit working papers being subject to formal review by the CIA • draft and final reports are checked and approved by the CIA and appropriate officers • this Manual setting out the various processes to ensure consistent conformance with PSIAS and the Code of Ethics. 26. Post-engagement client surveys to inform lessons learned, self-assessments, and other mechanisms to support continuous improvement are completed. These are issued at the end of each audit engagement with results acted upon and reported to the Committee. External Assessments (PSIAS 1312) 27. The Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) has developed a framework for undertaking external assessments as follows: • each local authority will be reviewed once every five years • the SLACIAG Committee oversee the framework’s implementation and provide a level of scrutiny and quality assurance to ensure the adequacy of the process and to arbitrate over any disputed outcomes as required • each authority is allocated another authority to assess • each Council’s CIA may appoint a team to undertake the assessment of the body to whom it has been appointed, with the CIA being responsible for authorising the final report • a qualified assessor, or assessment team, needs to demonstrate competence in two areas: the professional practice of internal auditing; and the external assessment process, and it is for the CIA of the body being assessed to determine whether the assessor or team is sufficiently competent. Where a team is undertaking the inspection, these competencies must be held by the team collectively and not necessarily by all individuals within the team.
Page 9
9 28. External assessors express an opinion on the entire spectrum of assurance and consulting work performed (or that should have been performed) by the internal audit activity, including its conformance with the Standards. Assessors also conclude on the efficiency and effectiveness of the internal audit activity in carrying out its charter and meeting the expectations of stakeholders. Reporting on the Quality Assurance and Improvement Programme (PSIAS 1320) 29. The CIA will report the results of the QAIP, via Committee papers, to the Strategic Management Team (SMT) and the Committee. International Standards for the Professional Practice of Internal Auditing’ (PSIAS 1321) 30. The CIA shall only state that the internal audit activity conforms with PSIAS if the results of the QAIP support this. Disclosure of Non-conformance (PSIAS 1322) 31. The CIA shall report any instances of non-conformance with the PSIAS to the Committee and consider including any significant deviations from the PSIAS in the governance statement where there is evidence to support this. Performance Managing the Internal Audit Activity (PSIAS 2000) 32. The work of Internal Audit is specified to deliver upon the requirements of the Annual Internal Audit Plan in accordance with the Charter and this Manual. 33. Internal audit activities are reviewed as part of the each audit assignment prior to the issuing of reports. This is to ensure that the work continues to reflect the definitions per the Charter and the Manual. The Manual in this iteration has been specified to reflect the requirements of the PSIAS published in March 2017. Planning (PSIAS 2010) 34. The Annual Internal Audit Plan is based on a documented risk assessment process. The Internal Audit plan will be developed based on a prioritisation of those key risks facing the Council including input of the SMT and the Committee. The plan will be flexible in nature, can be updated to reflect the changing risks and priorities of the Council, and will take into account: • the Council’s risk registers and risk management framework • a balance of coverage across all operational areas (this constitutes the assurance nature of the plan ensuring an adequate level of internal audit review annually within each service) • experience gained from previous Internal Audit activity • the impact of national issues (e.g. economic factors, the introduction of new legislation) • the impact of local issues (e.g. Corporate Plan and Corporate Improvement Plan) • periodic review of core financial and operational systems • the available audit resource and skills • staff development and training • time needed for the management of the Internal Audit service • contingency set aside for consultancy, reviews or investigations • liaison with other assurance providers such as the External Auditor and other scrutiny bodies.
Page 10
10 35. The risk based plan will include suitable flexibility to reflect the changing risks and priorities of the organisation with this being kept under review by the CIA during the course of the year. Such action may be taken in response to changes in the Council’s business, risks, operations, programmes, systems and controls. 36. Internal Audit may also provide consultancy work on the basis that it improves the management of risks, adds value and improves the Council’s operations. A specific contingency will be made in the internal audit plan to allow for management requests and consultancy work. The CIA will consider the effect on the opinion work before accepting consultancy work or management requests over and above the contingency allowed for in the internal audit plan. Such consultancy work will only be undertaken where resources permit without impacting on the annual assurance process. In line with the PSIAS, approval will be sought from the Committee before any significant unplanned consultancy work is accepted. Communication and Approval (PSIAS 2020) 37. The CIA communicates the planned internal audit activities, along with the resource requirements to the Committee for approval. Any significant revisions in the plan, resource limitations or requirements for additional resources shall be communicated to the SMT and the Committee for approval. Resource Management (PSIAS 2030) 38. The CIPFA Local Government Application note for applying PSIAS states that ‘No formula exists that can be applied to determine internal audit coverage needs. However, as a guide, the minimum level of coverage is that required to give an annual evidence based opinion. Local factors within each organisation will determine this minimum level of coverage’. 39. It is the CIA’s responsibility to ensure that resourcing arrangements are in place to deliver the annual risk based internal audit plan and that those resources are flexible enough to cope with special requests. Where applicable the CIA may seek additional input from external providers. 40. The internal audit plan will document the budgeted resource requirements for the audit year. It will also include a contingency to address unplanned work. Should circumstances arise during the year that suggests that available resource levels will fall or appear to be falling below the level required to deliver the plan, the CIA will communicate the impact of resource limitations and significant interim changes to the Committee. Policies and Procedures (PSIAS 2040) 41. This Manual serves as the Internal Audit’s policies and procedures. The Manual is specifically aligned to the provisions of the PSIAS and in complying with the Manual the team are demonstrating compliance with the standards. The Manual is reviewed, and presented to the Committee for approval, on an annual basis. Coordination and Reliance (PSIAS 2050) 42. The CIA is required to share information as appropriate with other providers of assurance and consulting services to ensure proper coverage and minimise duplication of efforts. 43. In preparing the Internal Audit Annual Plan, the CIA shall seek to establish the extent to which assurance can be placed on the work planned by external scrutiny bodies such as the Council’s External Auditors, Audit Scotland and also any internal control reviews undertaken by local management. This work informs our planned activities for the year with other sources of assurance being used to inform the annual assurance statement as well as future audit planning. However, the
Page 11
11 CIA accepts their accountability and responsibility for ensuring adequate support for conclusions and opinions reached by the assurance activity, no matter the source. Reporting to Senior Management and the Board (PSIAS 2060) 44. The CIA shall prepare and present performance reports to each sitting of the Committee. Performance reports will capture the activities of Internal Audit relative to the plan. 45. Ongoing reporting will also highlight specific issues as they relate to risk exposures, control issues, fraud, governance or any other matters that the CIA deems appropriate for consideration by the Committee. Significant issues will also be captured within the annual internal audit report. External Provider & Organisational Responsibility for Internal Auditing (PSIAS 2070) 46. Under any circumstances where an external internal audit service provider acts as the internal audit activity, the provider shall ensure that the Council is aware that the responsibility for maintaining an effective internal audit activity remains the responsibility of the Council. This is not applicable in the financial year 2024/25. Nature of the Work 47. Internal audit activity shall evaluate and contribute to the improvement of governance, risk management and control processes using a systematic and disciplined approach as outlined in the Charter. 48. Planned audit work includes consideration of a number of different types of audit assignments including systems, regularity, performance, consultancy, risk and IT. This varied application of audit resources ensures that different aspects of Council business have been subjected to testing with assurances being sought over a range of activities. Governance (PSIAS 2110) 49. The work of Internal Audit will include reviews to improve the Council’s governance processes for: • making strategic and operational decisions • overseeing risk management and control • promoting appropriate ethics and values within the Council • ensuring effective organisational performance management and accountability • communicating risk and control information to appropriate areas of the Council • coordinating the activities of and communicating information among the Committee, external and internal auditors, other assurance providers and management. 50. The work of Internal Audit shall also consider the design, implementation, and effectiveness of the Council’s ethics-related objectives, programmes and activities and that the Council’s information technology governance supports the organisation’s strategies and objectives. Risk Management (PSIAS 2120) 51. The work of Internal Audit shall evaluate the effectiveness of the Council’s risk management processes by determining whether: • organisational objectives support and align with the Council’s mission • significant risks are identified and assessed • appropriate risk responses are selected that align risks with the Council’s risk appetite
Page 12
12 • relevant risk information is captured and communicated in a timely manner across the Council, thus enabling the staff, management and the board to carry out their responsibilities. 52. Internal Audit will evaluate the risk exposure relating to the Council’s governance, operations and information systems regarding the: • achievement of the Council’s strategic objectives • reliability and integrity of financial and operational information • effectiveness and efficiency of operations and programmes • safeguarding of assets • compliance with laws, regulations, policies, procedures and contracts. 53. The consideration of risk shall be included in all audit assignments including those consultancy reports to ensure that they are consistent with the objectives of the engagement. 54. In completing audit assignments internal auditors shall also be alert to other significant risks and note these accordingly – informing management of possible work outside the scope of the audit where appropriate. 55. When assisting management in establishing or improving risk management processes, internal auditors must refrain from managing risks themselves, which would in effect lead to them taking on management responsibility. Control (PSIAS 2130) 56. The work of Internal Audit evaluates the adequacy and effectiveness of controls in the Council’s governance, operations and information systems regarding the: • achievement of the Council’s strategic objectives • reliability and integrity of financial and operational information • effectiveness and efficiency of operations and programmes • safeguarding of assets • compliance with laws, regulations, policies, procedures and contracts. 57. Internal auditors will utilise knowledge of controls gained during consulting engagements when evaluating the organisation’s control processes. Engagement Planning Engagement Objectives (PSIAS 2210) 58. Auditors are required to ensure that objectives have been agreed for each engagement. Inherent in this process is the need to carry out a preliminary risk assessment and a consideration of the probability of the following, when developing the engagement objectives: • significant errors • fraud • non-compliance • any other risks 59. At the start of all engagements (including consulting engagements), a Terms of Reference document showing the scope, objectives and associated risks of the review, plus anticipated timelines will be
Page 13
13 created. This will be agreed between the CIA and the Internal Audit team member assigned the audit. The Terms of Reference document will also be agreed by the appropriate Head of Service or delegated audit contact. Engagement Scope (PSIAS 2220) 60. The scope of the audit work should be established so that it is sufficient to satisfy the engagement’s objectives. The engagement scope should consider the following relevant areas of the Council (this should also consider relevant areas under the controls of outside parties): • systems • records • personnel • physical properties. 61. Where significant consulting opportunities have arisen during an assurance engagement, a specific written understanding as to the objectives, scope, respective responsibilities and other expectations should be developed and agreed with the CIA. 62. It is accepted that not all areas of a process will be reviewed at each audit, which might include geographical areas; the scope should be sufficient to satisfy the engagement objectives, but should also state, where appropriate, which areas are not covered. 63. For a consulting engagement, the scope of the engagement should be sufficient to address any agreed-upon objectives. If the internal auditors develop any reservations about the scope of a consulting engagement while undertaking that engagement, they are required to discuss those reservations with the relevant officer and the CIA to determine whether to continue with the engagement. 64. During consulting engagements, internal auditors are required to address the controls that are consistent with the objectives of those engagements. Engagement Resource Allocation (PSIAS 2230) 65. The CIA is required to decide upon the appropriate and sufficient level of resources required to achieve the objectives of the engagement based on the nature and complexity of each individual engagement, time constraints and the resources available. 66. An initial consideration of the resources required is in the audit plan, but this should be reviewed when the scope and objectives of the engagement are determined. Engagement Work Programme (PSIAS 2240) 67. The CIA has developed a template work programme which provides a clear link between the programme and the agreed terms of reference and Internal Auditors should use this template for all assignments. The template demonstrates how the work performed meets the agreed engagement objectives. 68. The work programme should be created by the internal audit team member assigned the audit, in discussion with the CIA, and include procedures for identifying, analysing, evaluating and documenting information. Work programmes for consulting engagements may vary in form and content depending on the nature of the engagement. This will require the approval of the CIA. 69. Work programmes must be approved by the CIA prior to implementation for each engagement and amended as necessary.
Page 14
14 Performing the Engagement Identifying Information (PSIAS 2310) 70. Internal auditors are required to identify sufficient, reliable, relevant and useful information to achieve each engagement’s objectives. 71. Sufficient information is factual, adequate and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Reliable information is the best attainable information through the use of appropriate engagement techniques. Relevant information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful information helps the organisation meet its goals. Analysis and Evaluation (PSIAS 2320) 72. When performing audits, internal auditors are required to base their conclusions and engagement results on appropriate analysis and evaluation whilst remaining alert to the possibility of: • intentional or unintentional wrongdoing • errors and omissions • poor value for money • failure to comply with Council policy • conflicts of interest. Documenting Information (PSIAS 2330) 73. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. 74. Records management must be consistent with the Council’s overall document retention policy, which is in turn consistent with the requirements of the Information Commissioner’s Office. Internal Audit record keeping must also be consistent with the specific requirements of the area audited, for example EU audits require documents to be kept for 7 years after the last payment has been made. 75. Electronic engagement records are kept in a restricted folder and on Sharepoint. ICT are responsible for the security controls, and the CIA is responsible for specifying who should have access to this. 76. The CIA shall obtain the approval of senior management and/or legal counsel as appropriate before releasing any engagement records to external parties. Engagement Supervision (PSIAS 2340) 77. All internal audit engagements shall be properly supervised to ensure that objectives are achieved, quality is assured and that staff are developed. 78. Appropriate evidence of supervision and management review should be documented and retained for each engagement. Communicating Results 79. Communicating the results of our internal audit work is a crucial aspect of the audit process and is the key link to our stakeholders including the SMT, Heads of Service, Elected Members, the Committee and (where appropriate) the public.
Page 15
15 Criteria for Communicating (PSIAS 2410) 80. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. Any deviation from the template report requires approval by the CIA. 81. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy. This will generally be carried out at a clearance meetings and a template has been created to facilitate and document that meeting. 82. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 83. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 84. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety this disagreement will be reported to the Committee as and when the report is presented. 85. In completing audit activities, auditors are required to include and disclose all material facts identified as part of their audit work and subsequent reports which, if not disclosed, could distort their reports or conceal unlawful practice. Such disclosures should be made with reference to confidentiality requirements or other considerations that may preclude the release of information into the public domain which are primarily outlined in Schedule 7A Exempt Information – Local Government (Scotland) Act 1973 or as amended. Quality of Communications (PSIAS 2420) 86. The work of Internal Audit should always seek to ensure that communications are accurate, objective, clear, concise, constructive, complete, and timely. Errors and Omissions (PSIAS 2421) 87. It is the CIA’s responsibility to ensure that where a final report contains a significant error or omission, subsequent changes, revisions or corrections are communicated to all parties who received the original communication. Use of ‘Conducted in Conformance with the International Standards for the Professional Practice of Internal Auditing’ (PSIAS 2430) 88. Internal Audit planning and the production of the audit reports will include reference to work being carried out ‘in conformance with the PSIAS’. Such disclosure requires underlying activities, such as the results of any QAIP and an assessment of conformance with the Manual. Such a statement can only be made where there is work to support this disclosure. Engagement Disclosure of Non-Conformance (PSIAS 2431) 89. Where any non-conformance with the PSIAS or Code of Ethics has impacted on a specific engagement, the communication of the results should include the following disclosures: • the principle(s) or rule(s) of conduct of the Code of Ethics or Standard(s) with which full conformance was not achieved • the reason(s) for non-conformance
Page 16
16 • the impact of non-conformance on the engagement and the engagement results. Disseminating Results (PSIAS 2440) 90. The CIA is responsible for determining the circulation of audit reports within the Council. This circulation should be mindful of confidentiality or the possibility of other legislative requirements. Standard practice is for the report to be issued to the: • Chief Executive • relevant Executive Director • relevant Head of Service • Head of Financial Services • SMT Admin (for inclusion in SMT meeting) • key audit contact • external audit • the Committee 91. The CIA shall determine whether there is any specific reason for the distribution list to be amended for any specific report. All audit reports are submitted in their entirety to the Committee which, through the transparent provision of committee papers, makes them public documents. In the event that the report contains sensitive information they may be restricted however this decision will only be taken in consultation with senior management and legal counsel as appropriate. Overall Opinion (PSIAS 2450) 92. The CIA will deliver an annual internal audit opinion and report that can be used by the Council to inform its governance statement. 93. The annual internal audit opinion must conclude on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control and include a statement on conformance with the PSIAS and the results of the QAIP. Monitoring Progress (PSIAS 2500) 94. Internal Audit are responsible for following up on agreed action plans to ensure those actions are properly implemented. On a quarterly basis services are contacted and asked to provide an update on progress against all open action plan points. This is reported to the SMT on a quarterly basis and as a standard agenda item to the Committee. Where a service reports an action has been closed Internal Audit ask for evidence to support that status. All action plan points will remain open until appropriate action is demonstrably taken by management or the risk of no action is formally accepted.