A1 EQA Report AB v2.0
Argyll and Bute Council · 16 March 2023
Back to Audit and Scrutiny Committee — 16 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
January 2023 Page 1 EXTERNAL QUALITY ASSESSMENT 2 OF ARGYLL & BUTE COUNCIL’S INTERNAL AUDIT SERVICE Report Recipients: Martin Caldwell, Chair of the Audit and Scrutiny Committee Pippa Milne, Chief Executive Ann Blue, Head of Financial Services Paul MacAskill, Chief Internal Auditor
Page 2
EXECUTIVE SUMMARY 2 1. INTRODUCTION 1.1 The mandatory Public Sector Internal Audit Standards (PSIAS), initially published in April 2013 and updated in March 2017, apply to all internal audit service providers in the UK public sector. To supplement the PSIAS, and provide specific guidance surrounding its application within a local government setting, the Chartered Institute of Public Finance and Accountancy (CIPFA) compiled a Local Government Application Note, last updated in 2019. 1.2 The objectives of the PSIAS are: to define the nature of internal auditing within the UK public sector; to set basic principles for carrying out internal audit; to establish a framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations; to establish the basis for the evaluation of internal audit performance; and to drive improvement planning. 1.3 The PSIAS require the Chief Audit Executive (the Chief Internal Auditor in Argyll & Bute Council) to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments. The external assessments must be carried out by a qualified, independent assessor from outwith the organisation, and enable evaluation of the internal audit activity’s conformance with the PSIAS, including the Mission of Internal Audit, Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. 1.4 To assist its members in meeting the five-yearly external assessment requirement, the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) established a collaborative system of formal peer reviews. This approach not only assists with ensuring that independent assessors, and their teams, have appropriate knowledge and experience of the local government internal audit environment but also removes the financial burden from councils associated with procuring these services externally. The independence of assessors was considered when allocating assessment teams to councils participating in the peer review process, ensuring that, amongst other governing principles, local authorities with perceived/known conflicts of interest could not review one another. At the outset, assessors were required to formally declare any interests so that these could be appropriately addressed during the allocation process. East Dunbartonshire Council was selected to carry out the external assessment of Argyll & Bute. 1.5 To support the peer review process, SLACIAG developed a comprehensive External Quality Assessment (EQA) framework, including an EQA Checklist for Assessing Conformance with the PSIAS and the Local Government Application Note (EQA Checklist) and a key Stakeholder Questionnaire proforma. East Dunbartonshire Council’s Internal Audit service has carried out the external assessment of Argyll & Bute Council’s Internal Audit service utilising this framework. 1.6 This report provides a high level summary of requirements for each standard per the PSIAS and CIPFA Local Government Application Note and details findings, conclusions and recommendations from the external assessment. This assessment has involved discussions with key members of staff, including the Chief Audit Executive, review of the most recent self-assessment carried out utilising the EQA Checklist and consideration
Page 3
EXECUTIVE SUMMARY 3 of other relevant supporting documentation/information (Evidence Pack) including working paper files and completed stakeholder questionnaires. A comprehensive list of supporting documentation/information and completed stakeholder questionnaires considered as part of the assessment can be found at appendices B and C respectively. 1.7 The Assessor would like to thank the Chief Internal Auditor (CIA) for the comprehensive audit pack that was provided, for the further information that was provided via interview and on request and for access to the Internal Audit Team members – this all enabled a smooth and efficient audit process. Thanks is also extended to all who gave up their time to complete the stakeholder questionnaires and to be interviewed – this enhanced the quality of the audit, allowing fuller picture of the Internal Audit Service to be obtained and thus a more accurate assessment.
Page 4
4 2. OVERALL CONCLUSION 2.1 The overall conclusion of the external assessment is that Argyll and Bute Council’s Internal Audit service fully conforms with the PSIAS. Two points for improvement have been noted with regards to Standard 2400 - Communicating Results and Standard 1100 - Independence and Objectivity. Both Standards have nonetheless been assessed as fully conforms due to the minor nature of the findings. A full summary of assessment, per assessment area, can be found at Appendix A. A summary of totals is as follows: Fully Conforms Generally Conforms Partially Conforms Does Not Conform TOTALS 14 0 0 0 2.2 The areas for improvement highlighted in the report are as follows: The annual governance statement for 2021/22 referred to the Contract Management Roads and Amenity Services audit conclusion of limited assurance. Whilst this was noted in a table in the annual audit report, it was not mentioned in the opinion or report wording. Instead, reference was made to ‘Subject to matters listed in the annual governance statement’ in the conclusion of the covering report. It may help the Audit and Scrutiny (A&S) Committee and provide clarity if such matters are specifically referred to in the Annual Audit Report. The register of interest which is used to identify potential conflicts of interest on internal audit work was noted during the review as having been last updated in February 2021. The risk is deemed to be low as during the review, Internal Audit staff demonstrated awareness of when they would flag any potential conflicts of interest to the Chief Internal Auditor. This action point has now been completed. Going forward, the CIA should ensure that the register of interest is updated at least annually in order to fully demonstrate compliance with PSIAS in this regard. 2.3 Full details of the assessment recommendations and management responses can be found in the Action Plan at Appendix D.
Page 5
5 3. SECTION A – MISSION OF INTERNAL AUDIT AND CORE PRINCIPLES The PSIAS state that the Mission of Internal Audit articulates what internal audit aspires to accomplish within an organisation, which is ‘to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight’. Taken as a whole, the Core Principles for the Professional Practice of Internal Auditing, as set out in the PSIAS, articulate internal audit effectiveness. For an internal audit function to be considered effective, all Core Principles should be present and operating effectively. Failure to achieve any of the Core Principles would imply that an internal audit activity was not as effective as it could be in achieving the Mission of Internal Audit. 3.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used, along with specific consideration surrounding the achievement of the Core Principles, to conclude that the Internal Audit service at Argyll & Bute Council fully conforms with accomplishing the Mission of Internal Audit as detailed above. 4. SECTION B – DEFINITION OF INTERNAL AUDITING The PSIAS state that internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 4.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used to conclude that the Internal Audit service at Argyll & Bute Council fully conforms with the definition of Internal Auditing as detailed above. The main reason for this assessment has been the review of the activities, approach and status of the Internal Audit service throughout the independent review. Completed Stakeholder Questionnaires support this conclusion. 4.2 The Internal Audit service does not currently carry out consulting activity; however, the Internal Audit Charter makes provision for the possibility of the service carrying out such work and specifies the parameters for accepting consulting engagements. 4.3 The Internal Audit service has in place an Internal Audit Charter and the definition of Internal Auditing included in this document mirrors the PSIAS definition. Furthermore, the Internal Audit Plan takes into account the PSIAS requirements, ensuing that the plan of work aligns to PSIAS. 5. SECTION C – CODE OF ETHICS The PSIAS state that the purpose of the Institute of Internal Auditor’s Code of Ethics is to promote an ethical culture in the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, control and governance. Internal auditors in UK public sector organisations must conform to the Code of Ethics as set out in the PSIAS. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. 5.1 Evidence obtained from assessing conformance with other standards in the PSIAS have been used to conclude that Argyll & Bute Council’s Internal Audit service fully conforms with the requirement to comply with the Code of Ethics. The following standards have been considered in particular: The Attribute Standards - 1000 – Purpose Authority and Responsibility,
Page 6
6 1100 – Independence and Objectivity, and 1200 – Proficiency and Due Professional Care. The Professional Standards - 2000 – Managing the Internal Audit Activity and 2300 – Performing the Engagement. 5.2 Completed Stakeholder Questionnaires also support the conclusion. In addition, the Audit Charter was reviewed and confirmed as being in line with good practice, adhering to the guidance. 6. SECTION D – ATTRIBUTE STANDARDS Attribute Standards apply to organisations and to individual internal auditors providing the internal audit service in a local authority. 6.1 1000 - Purpose, Authority, and Responsibility The PSIAS state that the purpose, authority and responsibility of the internal audit activity must be formally defined in an Internal Audit Charter, consistent with the Mission of Internal Audit and the mandatory elements of the International Professional Practices Framework. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval. The internal audit charter must also: define the terms ‘board’ and ‘senior management’ for the purposes of internal audit activity; cover the arrangements for appropriate resourcing; define the role of internal audit in any fraud-related work; and describe safeguards to limit impairments of independence or objectivity if internal audit or the chief audit executive undertakes non-audit activities. 6.1.1 Argyll & Bute Council’s Internal Audit Charter is periodically reviewed, with the most recent review taking place in March 2022. The requirements referred to above are adhered to in the Charter, and the Charter was approved by the A&S Committee on 15 March 2022. 6.1.2 Having considered the findings above, it has been concluded that the Internal Audit service at Argyll & Bute Council fully conforms with Standard 1000 on Purpose, Authority and Responsibility. 6.2 1100 - Independence and Objectivity The internal audit activity must be independent and internal auditors must be objective in performing their work. Various aspects of independence and objectivity are covered in this standard as well as 1200, including reporting functional lines of the CAE, the relationship between the CAE and the board and any impairment to individual internal auditor’s objectivity or independence. Reporting and management arrangements must be put in place that preserve the CAE’s independence and objectivity, in particular with regard to the principle that the CAE must be independent of the audited activities. 6.2.1 The CIA reports functionally to the A&S Committee and administratively to the Head of Financial Services, who attends the Council’s Strategic Management Team. The CIA has direct and unrestricted access to the Chief Executive and the Chair of the A&S Committee and this has been confirmed through the completed Stakeholder Questionnaires. These reporting and access arrangements are clearly defined in the
Page 7
7 Internal Audit Charter as are safeguards to limit impairment of independence or objectivity. 6.2.2 In support of organisational independence, the CIA attends A&S Committee meetings to present all internal audit reports (including, for example, the Internal Audit Charter, Annual Report, Internal Audit Plan and reports from the planned audits) to Elected Members. The reports are submitted in the CIA’s name. 6.2.3 The CIA has operational responsibility for the Counter Fraud Team and Risk Management and this is communicated to stakeholders via the Internal Audit Charter. 6.2.4 A minor point for improvement has been noted in that it has been observed that the register of interest, used to record potential conflicts of interest, appears to have been last updated in February 2021. Going forward, this should be updated on at least an annual basis. Nonetheless, from interviews with members of the Internal Audit Service, members of the team are aware of when they should flag potential conflicts with the CIA and so the risk is largely mitigated. See Appendix – Action 1. 6.2.5 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 1100 on Independence and Objectivity. 6.3 1200 - Proficiency and Due Professional Care The CAE must be professionally qualified, suitably experienced and responsible, in accordance with the organisation’s human resources processes, for recruiting appropriate staff. He or she is responsible for ensuring that up-to-date job descriptions exist, reflecting roles and responsibilities, and that person specifications define the required qualifications, competencies, skills, experience and personal attributes. The CAE should periodically assess individual auditors’ skills and competencies against those set out in the relevant job descriptions and person specifications. Any training or development needs identified should be included in an appropriate ongoing development programme that is recorded and regularly reviewed and monitored. In addition, all internal auditors have a personal responsibility to undertake a programme of continuing professional development (CPD) to maintain and develop their competence. This may be fulfilled through requirements set by professional bodies or through the organisation’s own appraisal and development programme. Auditors should maintain a record of such professional training and development activities. The internal audit activity should be appropriately resourced to meet its objectives. It should have appropriate numbers of staff in terms of grades, qualifications, personal attributes and experience or have access to appropriate resources in order to meet its objectives and to comply with these standards. The PSIAS states that the CAE must obtain competent advice and assistance if the activity is unable to perform all or part of an engagement. 6.3.1 The CIA is required to hold a relevant CCAB professional accountancy qualification and the CIA holds two such qualifications, Chartered Institute of Public Finance and Accountancy (CIPFA) and Chartered Institute of Internal Auditors (CIIA), and is suitably experienced. The CIA is a member of SLACIAG and regularly attends and contributes to meetings. Argyll & Bute Council’s Internal Audit service is represented on the two SLACIAG Sub-groups: the Computer Audit Sub-Group (CASG) and the Scottish Local Authorities Investigators Group (SLAIG). The CIA has a background in both financial and IT audit in the public sector. Questionnaires received from stakeholders have confirmed the opinion that the CIA is suitably experienced with 29 years of experience in public sector audit. 6.3.2 For the roles across the Argyll & Bute Council’s Internal Audit service, there are job and person specifications in place. There are a total of five members of staff in the Internal Audit service, including the CIA. The Internal Audit service delivers internal audit
Page 8
8 services to the Council, HSCP and ALEO. The team is highly qualified with a training plan is in place to address any skills gaps within the team and delivers a high quality service for the Council and which is evident by the questionnaires returned after the completion of each review. 6.3.3 The Internal Audit Team participate in a Performance Review and Development process. 6.3.4 The CIA and Audit Team have specific CPD requirements to adhere to. Each Auditor is a member of a professional body and is required to maintain a CPD file and in terms of CIPFA an annual declaration of compliance. 6.3.5 Argyll & Bute Council’s Internal Audit service fully conforms with standard 1200 on Proficiency and Due Professional Care. 6.4 1300 - Quality Assurance and Improvement Programme The PSIAS state that the Chief Audit Executive must develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outside the organisation, and enable evaluation of the internal audit activity’s conformance with the PSIAS, including the Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. The public sector requirement in the PSIAS states that results of the QAIP and progress against any improvement plans must be reported in the annual report. 6.4.1 Internal audit reports are reviewed by the CIA prior to issue and working papers are reviewed by the CIA. 6.4.2 Post audit surveys are sent to audit contacts after the completion of each audit to assess the performance and quality of reports. Internal audit have a positive performance target of 80% from these surveys and performance is monitored against this target. 6.4.3 Internal Audit monitor their development plan and the status of all development actions is reported to the A&S Committee as part of a standard agenda item. 6.4.4 An external assessment against Public Sector Internal Audit Standards was previously carried out by the Chief Internal Auditor for FTF Audit and reported to the A&S Committee in September 2018. The internal audit service was concluded as demonstrating overall compliance with PSIAS requirements, whilst four areas relating to risk were identified for improvement. An action plan was developed to address these areas and these improvement actions have been completed. 6.4.5 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 1300 on Quality Assurance and Improvement Programme. 7. SECTION E – PERFORMANCE STANDARDS Performance Standards describe the nature of the internal audit services being provided and provide criteria against which the performance of an internal audit function can be measured. 7.1 2000 - Managing the Internal Audit Activity The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organisation. The internal audit activity is effectively managed when
Page 9
9 it achieves the purpose and responsibility included in the internal audit charter, it conforms with the PSIAS, its individual members conform with the Code of Ethics and the PSIAS and it considers trends and emerging issues that could impact the organisation. The internal audit activity adds value to the organisation and its stakeholders when it considers strategies, objectives and risks; strives to offer ways to enhance governance, risk management, and control processes; and objectively provides relevant assurance. 7.1.1 An annual Internal Audit Plan is compiled by the CIA outlining the planned programme of work to be undertaken. The CIA attends SMT meetings on a fortnightly basis which ensures he is well sighted on the Council’s strategies, objectives and risks and of any issues that occur which may change the risk profile of the Council and, subsequently, areas for audit focus. In addition, the CIA reviews Business Plans, Local Outcome Agreement and Corporate and Operational Risk Registers. 7.1.2 The A&S Committee agrees and endorses the Internal Audit Plan. 7.1.3 The Internal audit service reports on performance to the Committee on a quarterly basis including full copies of audit reports issued, progress implementing audit recommendations, performance against agreed performance indicators and a summary of all internal audit activity in the previous quarter. 7.1.4 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 2000 on Managing the Internal Audit Activity. 7.2 2100 - Nature of Work The internal audit activity must evaluate and contribute to the improvement of the organisation’s governance, risk management, and control processes using a systematic, disciplined, and risk-based approach. Internal audit credibility and value are enhanced when auditors are proactive and their evaluations offer new insights and consider future impact. More specifically, the internal audit activity must assess and make appropriate recommendations to improve the organisation’s governance processes, evaluate the effectiveness and contribute to the improvement of risk management processes and assist the organisation in maintaining effective controls by evaluating their efficiency and effectiveness and promoting continuous improvement. 7.2.1 Audit work regularly focuses on areas of governance such as robustness of policies and procedures, performance reporting (which focuses on the achievement of strategic objectives), budget monitoring (financial information), and compliance with relevant legislation. 7.2.2 An audit assessing compliance with the Council’s risk management arrangements is performed every three years. 7.2.3 Controls are assessed through the internal audit plan and through considerations on individual assignments. 7.2.4 Fraud risks are considered and Internal audit carry out a programme of continuous monitoring which provides audit coverage across the main financial transactional processes on an annual basis. This helps to ensure there are good controls in relation to processing transactions which, in turn, reduces the risk of fraud. 7.2.5 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 2100 on Nature of Work.
Page 10
10 7.3 2200 - Engagement Planning Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing and resource allocations. The plan must consider the organisation’s strategies, objectives and risks relevant to the engagement. The CIPFA Local Government Application note states that for each engagement, a brief should be prepared, discussed and agreed with relevant managers. The brief should establish the objectives, scope and timing for the assignment and its resource and reporting requirements. Audit work should be undertaken using a risk-based audit approach. 7.3.1 Terms of Reference planning documents are in place which include objectives, scope, timing, resources allocated and consideration of the organisation’s strategies, objectives and risks relevant to the engagement. The final Terms of Reference document is agreed with the relevant Head of Service. 7.3.4 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 2200 on Engagement Planning. 7.4 2300 - Performing the Engagement Internal auditors must identify, analyse, evaluate and document sufficient information to achieve the engagement’s objectives. At each stage of the audit, auditors should consider what specific work needs to be conducted and evidence needs to be gathered to achieve the engagement objectives and support an independent and objective audit opinion. Systems should be in place to ensure that auditors obtain and record, within the working papers, sufficient evidence to support their conclusions, professional judgements and recommendations. Working papers should always be sufficiently complete and detailed to enable an experienced internal auditor with no previous connection with the audit to ascertain what work was performed, re-perform it if necessary and support the conclusions reached. The CAE should also specify how long all audit documentation should be retained, whether held on paper or electronically. All audit work should be subject to an appropriate internal quality review process. Internal auditors must be alert to the possibility of intentional wrongdoing, errors and omissions, poor value for money, failure to comply with management policy and conflicts of interest when performing their individual audits. They must also have sufficient knowledge to identify indicators that fraud or corruption may have been committed. 7.4.1 The Internal Audit Manual sets out the procedure in relation to undertaking a planned audit, including preparing working papers and setting up working paper files. 7.4.2 Electronic engagement records are kept in a restricted folder and on Sharepoint. ICT are responsible for the security controls, and the CIA is responsible for specifying who should have access to this. 7.4.3 Work Programmes have been standardised. These detail the test of control, the work performed, results, conclusion, issues raised and risk. 7.4.4 A standard template is also utilised for the CIA performing a review of the file – an audit review schedule, where any questions the CIA may have are noted for the auditor to answer. This helps to ensure consistency and quality of both the audit files and of the final report. 7.4.5 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 2300 on Performing the Engagement.
Page 11
11 7.5 2400 - Communicating Results The basic aims of every internal audit report should be to: give an opinion on the risk and controls of the area under review, building up to the annual opinion on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control; prompt management to implement the agreed actions for change leading to improvement in the control environment and performance; and provide a formal record of points arising from the audit and, where appropriate, of agreements reached with management, together with appropriate timescales. Each report should include the scope and purpose of the audit to help the reader to understand the extent, or limitations, of the assurance(s) provided by the report. During the course of the audit, key issues should be brought to the attention of the relevant manager to enable them to take corrective action and to avoid surprises at the closure stage. Before issuing the final report, the internal auditor should normally discuss the contents with the appropriate levels of management to confirm the factual accuracy, to seek comments and to confirm the agreed management actions. A draft report is useful for this purpose. Recommendations should be prioritised according to risk. The recommendations and the resultant management action plans should be agreed prior to the issue of the final report. Any areas of disagreement between the internal auditor and management that cannot be resolved by discussion should be recorded in the action plan and the residual risk highlighted. Those weaknesses giving rise to significant risks that are not agreed should be brought to the attention of a more senior level of management and the board. As set out in the PSIAS, the CAE must deliver an annual internal audit opinion and report that can be used by the organisation to inform its annual governance statement. This must include the annual internal audit opinion concluding on the overall adequacy and effectiveness of the organisation’s governance, risk and control framework, a summary of the audit work from which the opinion is derived (including reliance placed on work by other assurance bodies); and a statement of conformance with the PSIAS and the results of the internal audit QAIP. 7.5.1 Each report issued by Internal Audit outlines the auditors’ conclusions and significant issues identified. Reviews which identify significant or serious control weaknesses form part of the annual reporting and formal opinion reached in terms of the control environment. 7.5.2 As part of the standard audit approach, the team member carrying out the audit will have a feedback meeting with the key audit contact to discuss the arising issues. There will also be iterative communication with the key contact to clear the audit report. These communications are primarily made by e-mail due to the geographic spread of the Council. 7.5.3 With regards to handling disagreements, it is rare that a manager would not implement a recommendation. Internal Audit always aim to find common ground in relation to recommendations and implementation. In instances of unresolvable disagreement, the report would highlight that agreement could not be reached and the potential risk to the organisation. This would be reported to the A&S Committee. 7.5.4 The annual governance statement referred to the Contract Management Roads and Amenity Services having been given limited assurance. Whilst this was noted in a table in the annual audit report, it was not mentioned in the opinion wording. Instead, reference was made in the covering paper conclusion to ‘Subject to matters listed in the annual governance statement’. It may help the A&S Committee and provide clarity if
Page 12
12 such matters are specifically referred to in the Annual Audit Report and Opinion. See Appendix – Action 2. 7.5.5 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 2400 on Communicating Results. 7.6 2500 - Monitoring Progress The PSIAS place responsibility for monitoring progress with the CAE to ensure that management actions have been effectively implemented or, if not, that senior management have accepted the risk of not taking action. The CAE must, therefore, implement a follow-up process for ensuring the effective implementation of audit results or ensuring senior management are aware of the consequences of not implementing an action point and are prepared to accept the risk of such consequences occurring. The results of this process should be communicated to the board. The CAE should develop escalation procedures for cases where agreed actions have not been effectively implemented by the date agreed. These procedures should ensure that the risks of not taking action have been understood and accepted at a sufficiently senior management level. The effective involvement of the board in the follow-up process is critical to ensuring that it works. The CAE should consider revising the internal audit opinion in light of findings from the follow-up process. The findings of follow-up reviews should inform the planning of future audit work. 7.6.1 There is a comprehensive follow up programme in place whereby actions are followed up on a quarterly basis with the agreed responsible person in order to gauge and monitor progress with the agreed actions. 7.6.2 Progress with actions is reported to the Strategic Management Team and the A&S Committee on a quarterly basis. Follow-up results are also taken into account and referred to in the annual report. 7.6.3 Argyll & Bute Council’s Internal Audit service fully conforms with Standard 2500 on Monitoring Progress. 7.7 2600 - Communicating the Acceptance of Risks When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organisation, they must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, they must communicate the matter to the board. It is not the responsibility of the chief audit executive to resolve the risk. 7.7.1 The CIA has unrestricted access to the Chief Executive and Chair of the A&S Committee and can provide assurance that, should it be required, he can escalate issues directly to them. The CIA also attends SMT meetings giving him access to the SMT should he have any concerns that need to be raised. 7.7.2 All audit reports are taken to the A&S Committee and are presented to the SMT. 7.7.3 The CIA contributes to the annual governance statement and the annual audit opinion is reported to the A&S Committee. 7.7.4 Argyll & Bute Council’s Internal Audit service fully conforms to the Standard on Communicating the Acceptance of Risk. Gillian McConnachie CA Audit & Risk Manager and Chief Internal Auditor East Dunbartonshire Council January 2023
Page 13
13 APPENDIX A – SUMMARY OF ASSESSMENT REF PAGE No. ASSESSMENT AREA Fully Conforms Generally Conforms Partially Conforms Does Not Conform Section A 5 Mission of Internal Audit and Core Principles Section B 5 Definition of Internal Auditing Section C 5 Code of Ethics Section D 6 ATTRIBUTE STANDARDS 1000 6 Purpose, Authority and Responsibility 1100 6 Independence and Objectivity 1200 7 Proficiency and Due Professional Care 1300 8 Quality Assurance and Improvement Programme Section E 8 PERFORMANCE STANDARDS 2000 8 Managing the internal Audit Activity 2100 9 Nature of Work 2200 10 Engagement Planning 2300 10 Performing the Engagement 2400 11 Communicating Results
Page 14
14 2500 12 Monitoring Progress 2600 12 Communicating the Acceptance of Risks TOTALS 14 0 0 0
Page 15
15 APPENDIX B – EVIDENCE PACK The following represent the main sources of evidence that were considered in the course of the review: Minutes and papers from A&S Committee Audit Manual Stakeholder Questionnaires Interviews with the CIA, members of the audit team and an Executive Director Job Descriptions Code of Conduct Performance and Career Conversation Template Evidence of qualification Organisational chart Audit Survey Template CPD records Audit Survey Monitoring and Actions Prior EQA report Audit Plan Consultation HSCP Audit Plan Consultation Assurance Mapping Audit Universe Audit Plan Anti-Fraud Strategy LiveArgyll Service Level Agreement A sample of audit files APPENDIX C – STAKEHOLDER QUESTIONNAIRES Stakeholder questionnaires were completed by the following key members of staff and Elected Members: Martin Caldwell, Chair of the A&S Committee Pippa Milne, Chief Executive Kirsty Flanagan, Executive Director Douglas Hendry, Executive Director
Page 16
16 APPENDIX D – ACTION PLAN No. Para Recommendation Management Response Responsible Officer / Agreed Completion Date 1 6.2.4 The register of interest which is used to identify potential conflicts of interest on internal audit work appears to have been last updated in Feb 2021. The risk is deemed to be low as staff demonstrate awareness of when they would flag any potential conflicts of interest to the Chief Internal Auditor. Nonetheless the register should be updated as soon as practical and annually thereafter in order to fully demonstrate compliance with PSIAS in this regard. Whilst there was a register of interest in place for staff, this should have been reviewed annually as outlined in the recommendation. This has since been fully reviewed and updated and an updated copy has been provided to the Assessor as evidence of completion. Completed 21st December 2022. 2 7.5.4 The annual governance statement for 2021/22 referred to the Contract Management Roads and Amenity Services audit conclusion of limited assurance. Whilst this was noted in a table in the annual audit report, it was not mentioned in the opinion or report wording. Instead, reference was made to ‘Subject to matters listed in the annual governance statement’ in the conclusion of the covering report. It may help the Audit and Scrutiny Committee and provide clarity if such matters are specifically referred to in the Annual Audit Report. This will be addressed as part of the review of the Annual Governance Statement and also the production of the Internal Audit Annual Report for 2022/23. August 2023 Critical Significant Routine