ABC Internal Audit Charter (March 2023)
Argyll and Bute Council · 16 March 2023
Back to Audit and Scrutiny Committee — 16 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Charter March 2023
Page 2
2 Contents Introduction ....................................................................................................................................... 3 Internal Audit Mission (PSIAS Section 3) ............................................................................................. 3 Definition of Internal Auditing (PSIAS Section 4).................................................................................. 3 Definition of Roles.............................................................................................................................. 3 Purpose of Internal Audit ................................................................................................................... 3 Authority and Scope ........................................................................................................................... 4 Independence and Objectivity ............................................................................................................ 4 Organisation ...................................................................................................................................... 5 Resourcing ......................................................................................................................................... 5 Responsibility and Scope .................................................................................................................... 6 Fraud and Corruption ......................................................................................................................... 6 Professionalism .................................................................................................................................. 7 Internal Audit Plan ............................................................................................................................. 7 Reporting and Monitoring .................................................................................................................. 8 Periodic Assessment........................................................................................................................... 8 Approval ............................................................................................................................................ 8
Page 3
3 Introduction 1. The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Public Sector Internal Audit Standards (the Standards), which came into effect in April 2013, and were updated in March 2017. 2. The Standards require the Argyll and Bute Council (the Council) to have an Internal Audit Charter (the Charter), consistent with the Mission of Internal Audit, that defines internal audit’s purpose, authority and responsibility. Internal Audit Mission (PSIAS Section 3) 3. It is internal audit’s mission to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. Definition of Internal Auditing (PSIAS Section 4) 4. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve the Council’s operations. It helps the Council accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Definition of Roles 5. The Standards require that the Internal Audit Charter defines the terms ‘board’, ‘senior management’ and ‘Chief Audit Executive’ in relation to the work of Internal Audit. For the purposes of Internal Audit work: Board - refers to the Council’s Audit and Scrutiny Committee (the Committee) which has delegated responsibility for overseeing the work of Internal Audit Senior management - is defined as the Chief Executive and members of the Council’s Strategic Management Team (SMT) Chief Audit Executive - refers to the Chief Internal Auditor (CIA). Purpose of Internal Audit 6. The main objective of Internal Audit is to provide, in terms of the PSIAS, a high quality, independent audit service to the Council which provides annual assurances in relation to internal controls and overall governance arrangements. In addition to this primary assurance role, Internal Audit will also: support the Executive Director (Kirsty Flanagan) (s95 officer) and the Committee in the discharge of their duties support the Council’s Monitoring Officer (Douglas Hendry) support the Council’s anti-fraud and corruption arrangements provide advice and guidance on control implications for new or changed systems where appropriate support the Council and the SMT during key transformational / change projects.
Page 4
4 7. Internal Audit may also provide an independent and objective consultancy service, which is advisory in nature and generally performed at the specific request of service management. The aim of the consultancy service is to help line management improve the Council’s risk management, governance and internal control. A specific contingency will be made in the internal audit plan to allow for management requests and consultancy work. The CIA will consider the effect on the opinion work before accepting consultancy work or management requests over and above the contingency allowed for in the internal audit plan. Such consultancy work will only be undertaken where resources permit without impacting on the annual assurance process. In line with the PSIAS, approval will be sought from the Committee before any significant unplanned consultancy work is accepted. 8. The Internal Audit activity is established by the Committee with Internal Audit’s responsibilities defined by the Committee as part of their oversight role. Authority and Scope 9. Internal audit, with strict accountability for confidentiality and safeguarding records and information, has authorised full, free, and unrestricted access to any and all of the Council’s records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist Internal Audit in fulfilling its roles and responsibilities. Internal Audit, through the CIA, will also have free and unrestricted access to the Committee. Designated auditors are entitled, without necessarily giving prior notice, to require and receive: access to all records, documents and correspondence relating to any financial or other relevant transactions, including documents of a confidential nature access at all reasonable times to any land, premises, officers and members of the Council the production of any cash, stores or other property of the Council under an officer’s and member’s control explanations concerning any matter under investigation. 10. Where the Council works in partnership with other organisations, the role of internal audit will be defined on an individual basis. Where Internal Audit undertakes work on behalf of any other organisations, this will be determined in conjunction with the Committee and in consultation with the SMT to ensure that appropriate audit resources are available to provide assurance over the Council’s activities. Internal Audit currently provide audit services to LiveArgyll, the arrangements for internal audit have been agreed with LiveArgyll’s General Manager who reports to LiveArgyll’s Finance and Audit Sub-Committee. As of 1 April 2021 Internal Audit will be proving audit services to the Argyll and Bute Health and Social Care Partnership (HSCP). Arrangements for that service have been agreed with the HSCP’s Head of Finance and Transformation. Independence and Objectivity 11. Internal Audit will remain free from interference by any element in the organisation, including matters of audit selection, scope, procedures, frequency, timing, or report content. This will ensure that the work of Internal Audit is independent and objective. 12. Internal auditors will have no direct operational responsibility or authority over any of the activities audited. Accordingly, they will not implement internal controls, develop procedures, install systems, prepare records, or engage in any other activity that may impair the internal auditor's judgment.
Page 5
5 13. The CIA has additional responsibilities for risk management and counter fraud arrangements. The CIA will declare an interest for audit assignments in these areas with the next most senior internal audit team member taking additional reporting responsibilities where such conflicts arise. This arrangement will address the recognised independence issues arising from the CIA’s other responsibilities. A further option, if required, is for the CIA of another local authority to provide oversight of an audit where there is a possible conflict of interest. 14. Internal auditors must exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined, as detailed in the Chartered Institute of Internal Audit’s Code of Ethics. 15. Internal auditors must also make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments, as detailed in the 7 Principles of Public Life (the ‘Nolan principles’). 16. Each member of the Internal Audit team completes a register of interest and updates it, at a minimum, on an annual basis. 17. The CIA will confirm to the committee, at least annually, the organisational independence of Internal Audit. Organisation 18. The CIA is the officer responsible to the Committee for the provision of an independent Internal Audit service. The CIA will discharge this responsibility through the direct application of internal audit resources. 19. The CIA reports, on an administrative basis, to the Head of Financial Services who is a member of the SMT. However the CIA also has unrestricted access to those charged with governance, specifically: Elected Members; the Chief Executive; Executive Directors including the Executive Director who is the Council’s Monitoring Officer. 20. The CIA has direct access to the Chair of the Committee to discuss any matters the Committee or auditors believe should be raised privately. One of the functions of the Committee is to ensure that no unjustified restrictions and limitations are made to the scope and activities of Internal Audit. Additionally, unrestricted access to all Officers of the Council is afforded to all members of the Internal Audit service. 21. The CIA is required to hold a professional qualification and be suitably experienced with other team members having suitable experience and/or be working towards a relevant qualification. Resourcing 22. The CIPFA Local Government Application note for applying PSIAS states that ‘No formula exists that can be applied to determine internal audit coverage needs. However, as a guide, the minimum level of coverage is that required to give an annual evidence based opinion. Local factors within each organisation will determine this minimum level of coverage’. 23. It is the CIA’s responsibility to ensure that resourcing arrangements are in place to deliver the annual risk based internal audit plan and that those resources are flexible enough to cope with special requests. Where applicable the CIA may seek additional input from external providers. 24. The internal audit plan will document the budgeted resource requirements for the audit year. It will also include a contingency to address unplanned work. Should circumstances arise during the year that suggests that available resource levels will fall or appear to be falling below the level required
Page 6
6 to deliver the plan, the CIA will communicate the impact of resource limitations and significant interim changes to the Committee. Responsibility and Scope 25. The scope of internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the Council's governance, risk management, and internal control processes in relation to the Council's defined goals and objectives. This recognises that Internal Audit’s remit extends to the entire control environment of the organisation. 26. Internal Audit is not a substitute for the operation of effective internal controls, which are the direct and sole responsibility of management. However, Internal Audit’s specific commitments do include (but are not necessarily limited to) the following: examining and evaluating the adequacy of the Council's system of internal control, including those pertaining to the deterrence, detection and investigation of fraudulent or illegal acts reviewing the reliability and integrity of financial and operating information and the means used to identify, measure, classify and report such information reviewing the systems established to ensure compliance with those policies, plans, procedures, laws and regulations which could have a significant impact on operations reviewing the means of safeguarding assets and, as appropriate, verifying the existence of such assets appraising the economy and efficiency with which resources are employed and the quality of performance in carrying out assigned responsibilities coordinating Internal Audit activities with the work of the External Auditors and assisting them as required. 27. Based on its activity, Internal Audit is responsible for reporting significant risk exposures and control issues identified to the Committee and the SMT including fraud risks, governance issues, and other matters needed or requested by the Committee. Fraud and Corruption 28. Managing the risk of fraud and corruption is the responsibility of the SMT. Management is also responsible for developing, implementing and maintaining systems of internal control to guard against fraud or irregularity and ensure probity in systems and operations. Internal Audit will assist management by reviewing the controls and procedures in place. 29. Audit procedures alone cannot guarantee that fraud and corruption will be detected, nor does Internal Audit have the responsibility for prevention and detection of fraud. However, individual auditors will be alert in their work to risks and exposures that could allow a fraud, irregularity or corrupt practice to take place. 30. Where any matter arises which involves, or is thought to involve, a fraud, corruption or financial irregularity, the relevant Head of Service / Executive Director will notify the Council’s Monitoring Officer, Head of Financial Services and the CIA for consideration of appropriate action. Further guidance can be found in the Council’s Anti-Fraud strategy and Public Interest Disclosure Policy. The Council’s Counter Fraud Team reports directly to the CIA so the CIA will be involved in overseeing any investigation and will liaise with the Council’s Monitoring Officer during the investigation of the alleged fraud and in particular:
Page 7
7 examine current Council policies, procedures and financial controls, their current working and effectiveness in relation to the alleged fraud report to the SMT in relation to the adequacy of current Council policies, procedures and financial controls in relation to the alleged fraud and make recommendations for their revision provide advice and assistance to the Monitoring Officer in relation to Council policies, procedures and financial controls and control issues relevant to the investigation of the alleged fraud. Professionalism 31. Internal Audit will adhere to the Standards, which are based on the Chartered Institute of Internal Auditors' mandatory guidance including the Definition of Internal Auditing, the Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing. This mandatory guidance constitutes principles of the fundamental requirements for the professional practice of Internal Auditing and for evaluating the effectiveness of the Internal Audit’s performance. 32. Other professional guidance will also be adhered to as applicable to guide operations. In addition, Internal Audit will adhere to the Council’s relevant policies and procedures and Internal Audit’s manual. 33. To ensure that auditors maintain and enhance their knowledge, skills and audit competencies an updated approach to the PRD process, based on measuring and improving outcomes from conversations between managers and employees about performance and career/development aspirations will be adopted. This process will be undertaken on an annual basis. Internal Audit Plan 34. At least annually, the CIA will submit an Internal Audit plan that includes risk assessment criteria to the Committee for review and approval. The CIA will communicate the impact of any resource limitations and significant interim changes to the SMT and the Committee. 35. The Internal Audit plan will be developed based on a prioritisation of those key risks facing the Council including input of the SMT and the Committee. The plan will be flexible in nature, can be updated to reflect the changing risks and priorities of the Council, and will take into account: the Council’s risk registers and risk management framework a balance of coverage across all operational areas (this constitutes the assurance nature of the plan ensuring an adequate level of internal audit review annually within each service) experience gained from previous Internal Audit activity the impact of national issues (e.g. economic factors, the introduction of new legislation) the impact of local issues (e.g. corporate or service action plans) periodic review of core financial and operational systems the available audit resource and skills staff development and training time needed for the management of the Internal Audit service contingency set aside for consultancy, reviews or investigations
Page 8
8 liaison with other assurance providers such as the External Auditor and other scrutiny bodies. Reporting and Monitoring 36. Following the conclusion of each Internal Audit engagement, a written report will be prepared, reviewed by the CIA and distributed as appropriate. Internal Audit reports will also be presented to the Committee. LiveArgyll audit reports will also be presented to their Finance and Audit Sub- Committee by the LiveArgyll General Manager. Any audit reports relating to social work services will also be presented to the Argyll and Bute HSCP Audit and Risk Committee. 37. The internal audit report will include management's response and corrective action taken or to be taken in regard to the specific issues and risks. Management's response should include a timetable for anticipated completion of action to be taken and an explanation for any corrective action that will not be implemented. 38. Internal Audit will be responsible for appropriate follow-up on engagement findings and actions. All findings will remain open until appropriate action is demonstrably taken by management or the risk of no action is formally accepted. Periodic Assessment 39. Internal Audit is subject to a Quality Assurance and Improvement Programme that covers all aspects of Internal Audit activity. This consists of an internal annual self-assessment of the service and its compliance with the Standards and ongoing performance monitoring. The adequacy of Internal Audit is also assessed on an annual basis by the Council’s external auditors. 40. External assessments against the Standards will be conducted at least once every five years by a suitably qualified, independent assessor. These reviews form part of a national peer review programme administered by the Scottish Local Authorities Chief Internal Auditor Group. 41. The conclusions of all internal and external assessments will be reported to the Committee. Approval 42. This Charter was reported to and approved by the Committee at its meeting on 16 March 2023 and shall be subject to regular review by the CIA and the Committee.