202122 Internal Audit Annual Report Appendix 2 - Internal Audit Opinion

Argyll and Bute Council · 23 June 2022
Back to Audit and Scrutiny Committee — 23 June 2022 and its agenda

Text extracted from the council's PDF. Layout and reading order may differ from the original.

Original council PDF · Download plain text

Page 1

Appendix 2 - 2021/22 Internal Audit Opinion 
To the Members of Argyll and Bute Council, the Chief Executive, other
members of the Council’s Senior Management Team including the Section 95
Officer 
As the Interim Chief Internal Auditor of Argyll and Bute Council (the Council), I am
pleased to present my annual statement on the adequacy and effectiveness of the
internal financial control system of the Group Accounts prepared by the Council for
the year ended 31 March 2022. 
Respective responsibilities of management and internal auditors in relation to
internal control 
It is the responsibility of the Council’s senior management to establish an appropriate
and sound system of internal financial control and to monitor the continuing
effectiveness of that system. It is the responsibility of the Chief Internal Auditor to
provide an annual overall assessment of the robustness of the internal financial
control system. 
The Council’s framework of governance, risk management and internal control 
The Council has a responsibility to ensure that its business is conducted in
accordance with legislation and proper standards. The governance framework
comprises the systems and processes, culture and values by which the Council is
directed and controlled and how it accounts to communities. It enables the Council to
monitor the achievement of its strategic priorities and to consider whether those
objectives have led to the delivery of appropriate services and value for money. 
The main objectives of the Council’s internal control systems are to ensure: 
 adherence to management policies and directives in order to achieve the
organisation’s objectives
 economic, efficient, effective and safe use of resources and assets
 the relevance, reliability and integrity of information, so ensuring as far as
possible the completeness and accuracy of records
 compliance with statutory requirements. 
The system of internal control is a significant element of the governance framework.
Any system of control can only ever provide reasonable and not absolute assurance
that control weaknesses or irregularities do not exist or that there is no risk of
material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the
Council is continually seeking to improve the effectiveness of its systems of internal
control in order to identify and prioritise the risks that would prevent the achievement
of the Council’s strategic objectives. 
The work of internal audit 
Internal auditing is an independent, objective assurance and consulting activity
designed to add value and improve an organisation’s operations. It helps an

Page 2

organisation accomplish its objectives by bringing a systematic, disciplined approach
to evaluate and improve the effectiveness of risk management, control and
governance processes. 
The Council’s Internal Audit Section operates in accordance with the Public Sector
Internal Audit Standards (PSIAS) which have been agreed to be adopted from 1 April
2013 by the relevant public sector Internal Audit Standard setters. PSIAS applies the
Institute of Internal Auditors International Standards to the UK Public Sector. 
PSIAS requires that a Quality Assurance and Improvement Programme (QAIP) is
developed in order to provide assurance that internal audit activity: 
 is conducted in accordance with an Internal Audit Charter
 operates in an efficient and effective manner
 is perceived to be adding value and improving operations. 
PSIAS also requires, as outlined in Standard 1300 “QAIP”, that: 
“External assessments must be conducted at least once every five years by a
qualified, independent assessor or assessment team from outside the
organisation. External assessments can be in the form of a full external
assessment or a self-assessment with independent external validation”. 
To meet this requirement, a reciprocal arrangement to complete a programme of
inspections has been developed by the Scottish Local Authorities Chief Internal
Auditors Group (SLACIAG). This process identified FTF Consortium as the body to
undertake the independent review of the Council’s Internal Audit function’s level of
compliance with PSIAS. This output of this review was presented to the Audit and
Scrutiny Committee in September 2018. It concluded that the internal audit service
demonstrates overall compliance with PSIAS and identified many areas of strong
practice including sound governance, robust self-assessment, good engagement
and clear reporting lines and clear evidence of supervision and audit follow up. A
further self-assessment process was undertaken and reported to Committee in
September 2021 which provided further assurance Internal Audit’s compliance with
PSIAS.   
Internal Audit undertakes an annual programme of work based on a risk assessment
process which is revised on an ongoing basis to reflect evolving risks and changes
within the Council. 
All Internal Audit reports identifying system weaknesses and / or non-compliance
with expected controls are brought to the attention of management and the Audit and
Scrutiny Committee together with appropriate recommendations and agreed action
plans. It is management’s responsibility to ensure that proper consideration is given
to Internal Audit reports and that appropriate action is taken on audit
recommendations. 
The internal auditor is required to ensure that appropriate arrangements are made to
determine whether action has been taken on internal audit recommendations or that
management has understood and assumed the risk of not taking action. A

Page 3

programme of follow-up on assignment findings and recommendations provides
assurance on the complete and timeous implementation of internal audit
recommendations. 
Internal Audit staff regularly attended the following external user group meetings: 
 SLACIAG, the purpose of which is to develop and improve the practice of
internal audit activity with Scottish local authorities. It achieves this by meeting
to discuss issues of common concern, commissioning work to develop ideas,
sharing good practice, working in partnership with other professional /
governing bodies and promoting SLACIAG as the representative body for
internal audit in local authorities. We have attended meetings of SLACIAG
during 2021/22. 
 SLACIAG Computer Audit sub group: unfortunately we were unable to attend
this group during 2020/21.  However, outputs and communications are
regularly exchanged ensuring that audit teams are better equipped to perform
technical Information Systems auditing. We attended a SLACIAG meeting
which focussed on cyber risks, resilience and incident management. 
 The CIA also meets the Chief Internal Auditors of West Dunbartonshire
Council, East Dunbartonshire Council, West Lothian Council, Falkirk Council
and Inverclyde Council on a quarterly basis to discuss developments and
share knowledge. In-between these meetings we are in regular contact to
share information which helps deliver audit plans more efficiently including
consistent use of benchmarking indicators. 
Basis of Opinion 
My evaluation of the control environment is informed by a number of sources: 
 the audit work undertaken by Internal Audit during the year to 31 March 2022,
including risk based audits, continuous monitoring and follow-up activity. 
 the assurance statements signed by the executive directors and heads of
service on the operation of the internal financial controls for the services for
which they were responsible during the year to 31 March 2022. 
 the assurance statement signed by the Chief Executive for the overall Council
for the year ended 31 March 2022. 
 reports issued by the Council’s external auditors, Audit Scotland, and other
external review agencies. 
 my knowledge of the Council’s governance, risk management and
performance monitoring arrangements.

Page 4

Limitation to Resources or Scope of Internal Audit Work 
The previous Head of Financial Services was appointed as Executive Director whilst
retaining the Council’s Section 95 officer responsibilities.  Backfilling of the Head of
Financial Services post was undertaken by the Chief Internal Auditor on an interim
basis until December 2021 after which the Finance Manager undertook this role
when the post became vacant again. During the year the role of Chief Internal
Auditor was subsequently filled on an interim basis from September 2021. I can
report that Internal Audit operated throughout 2021/22 with no impairments or
restrictions in scope or independence. 
There were sufficient resources available to deliver the amended programme of audit
assignments contained within the revised 2021/22 Internal Audit Plan and no
significant threats emerged to the independence of the internal audit activity such as
inappropriate scope or resource limitations. 
Opinion 
It is my opinion, based on the above, that reasonable assurance can be placed upon
the adequacy and effectiveness of the Council’s systems of governance, risk
management and internal control in the year to 31 March 2022. 
Signature: 
Title: Interim Chief Internal Auditor
Date: 23 June 2022