9 - Internal Audit Plan 2026-27
North Ayrshire Council · 12 March 2026
Back to Audit and Scrutiny Committee — 12 March 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
OFFICIAL INFORMATION OFFICIAL INFORMATION NORTH AYRSHIRE COUNCIL 12 March 2026 Audit and Scrutiny Committee Title: Internal Audit Plan 2026/27 Purpose: To inform the Committee of the proposed internal audit plan for 2026/27. Recommendation: That the Committee approves the internal audit plan for 2026/27. 1. Executive Summary 1.1 Internal Audit provides an independent and objective opinion on the Council’s risk management, governance and control environment by evaluating its effectiveness. This report presents the proposed internal audit plan for 2026/27. 1.2 Prior to the start of each financial year internal audit, in conjunction with senior management, put together a proposed plan of audit work. The objective of our planning process and subsequent plan is to put us in a position to provide a well- informed and comprehensive annual audit opinion, based on sufficient and appropriate coverage of key business objectives and risk management processes. 1.3 The proposed internal plan is risk-based and provides sufficient coverage to support an annual audit opinion while retaining the flexibility to respond to emerging risks. 2. Background Internal Audit Plan 2026/27 2.1 The 2026/27 plan has been developed using the rolling approach first used in 2024/25 and continued in 2025/26. This method ensures the plan remains flexible and responsive to changing risks across the Council. The plan is essentially two phased: • Phase 1, this paper, will cover quarters 1 and 2 in terms of the planned audits for the first 6 months of the financial year. • Phase 2, or the mid-year review, will identify the audits to be carried out in quarters 3 and 4. • Quarter 3 and 4’s audits are selected from the rolling list of potential audit assignments.
Page 2
OFFICIAL INFORMATION OFFICIAL INFORMATION 2.2 The benefit of this approach is that it allows the internal audit team to remain flexible, agile and capable of responding to emerging risks. This approach is also in line with the new Global Internal Audit Standards (GIAS) which came into effect on 1 April 2025 and require the audit plan to be risk-based. 2.3 Several factors are considered when putting together the risk based internal audit plan for 2026/27, including: • Consultation with senior management across all services; • Review of the Council’s key objectives and Council Plan 2023-2028; • Review of the audit universe, in conjunction with senior management; • Review of the Council’s fundamental business processes and key services; • Review of the Council's current risk management framework, processes and risk management maturity; • Review of the key risks featuring in the Council's risk registers; • Internal Audit’s own risk assessment based on knowledge of the business and incorporating findings from previous internal audit work; and • Internal Audit’s awareness of emerging regional and national risk factors. 2.4 The risk universe is a documented risk assessment maintained by internal audit and used to document the consultation which takes place between internal audit and senior management. It outlines risk factors such as: • Links to the strategic priorities within the Council Plan for 2023-2028; • Links to strategic, corporate and operational risk registers; • Whether the auditable area is a source of significant risk; • Whether there is significant value to the Council in the audit being carried out; • Known risk factors arising from local and national issues; and • Risk factors arising from previous internal audit work and knowledge of the Council. 2.5 An overall conclusion is reached from an assessment of each risk area, which categorises audits into the following priorities: • Priority A – a ‘must do’ audit based on risk (very high risk); • Priority B – a ‘should do’ audit, time permitting (high risk); • Priority C – a ‘may do’ audit, time permitting (moderate risk); and • Priority D – an audit where the result would not be of sufficient value to the Council (low risk). 2.6 Examples of the key risk factors which have influenced the early part of the 2026/27 internal audit plan are as follows: • Cyber resilience continues to be a high priority across organisations and is identified as a strategic risk for the Council. The Internal Audit team has, over a number of years, utilised the Scottish Government’s Cyber Resilience Framework as the basis for ICT audit work, and this risk-based approach will continue to inform the 2026/27 audit plan. • The enacting of legislation such as Awaab’s Law will see the implementation of legally enforced deadlines for investigations and repairs. Internal Audit will
Page 3
OFFICIAL INFORMATION OFFICIAL INFORMATION provide assurance to the Council through planned work relating to dampness and mould. • The Council has recently implemented, or is the process of implementing, significant system changes, including upgrades to the general ledger and the introduction of a new social work system within the HSCP. Effective implementation and control of these systems is critical, given their role in producing reliable management and financial information. 2.7 The overall objective of the work of internal audit is to enable the Senior Manager to form an evidence based independent opinion at the end of the year on the adequacy of the Council’s internal control, risk and governance arrangements. This opinion, which will be outlined in the annual audit report, also forms part of the Annual Governance Statement for the year which is included within the Council’s financial statements. 2.8 Whilst the audit plan is risk based and the current work has identified audits planned for the first 6 months of the year, it is also agile. The implications of this are that previously agreed work could be deferred should a new risk profile arise. Any such changes will be presented back to the committee through the regular reporting to Audit & Scrutiny. 2.9 Internal audit coverage can never be absolute, and responsibility for risk management, governance and internal control arrangements will always remain fully with management. As such, internal audit cannot provide complete assurance over any area, and equally cannot provide any guarantee against material errors, loss or fraud. 2.10 Appendix A contains the internal audit plan for quarters one and two of 2026/27. The plan will be added to throughout the year, with a list of potential audit areas provided at Appendix B. Audit titles and high-level scopes are indicative at this stage for planning our resources. At the start of each audit, detailed planning will be carried out to agree the objectives and the scope of the work. The plan will therefore be subject to change throughout the year, depending on several factors such as available resources, time required to complete reviews, and unplanned work arising throughout the year. 2.11 The Senior Manager is required to ensure that internal audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. The Internal Audit Team currently comprises a Senior Manager, an Internal Audit Manager, two Internal Auditors and a Computer Auditor. All members of the team hold professional accountancy or audit qualifications and are suitably experienced. 2.12 In addition to the programme of audit work to be carried out, time is also required to be set aside throughout 2026/27 to support the following areas: • Consultancy – both ad hoc advice and project work • Follow up of prior year internal audit action points • Staff training • Audit planning and monitoring • Committee attendance and reporting • Development of the internal audit service • Self-assessment on the new Global Internal Audit Standards • Review of governance documents such as the Annual Governance Statement.
Page 4
OFFICIAL INFORMATION OFFICIAL INFORMATION Conformance with the Global Internal Audit Standards (GIAS) 2.13 The Global Internal Audit Standards came into effect in April 2025, replacing the Public Sector Internal Audit Standards (PSIAS). The Senior Manager will complete a self-assessment against the new standards, the results of which will be included within the annual audit report. 2.14 The outcome of this self-assessment may identify areas where changes to internal audit processes or procedures are required. Any such changes will be captured within a formal action plan with clearly defined timescales for implementation. 2.15 Completion of this self-assessment will also form a key element of preparation for the External Quality Assessment (EQA) of the internal audit function, which is scheduled to be undertaken in 2027. The most recent EQA was carried out in 2022 under the now superseded PSIAS and concluded that the internal audit service was fully or generally conformant with all 14 standards. This provides a strong foundation from which the service can move towards full conformance with the Global Internal Audit Standards. 2.16 Similar to PSIAS, the GIAS require the Senior Manager to develop and maintain a quality assurance and improvement programme (QAIP). The planned self- assessment due will provide a key foundation for this programme, alongside the EQA planned for in 2027. Internal Audit Performance 2.17 As part of the progress reporting regime, we will report on internal audit performance. The following targets will be used to measure the performance of the internal audit activity Performance Measure Performance Target Delivery of internal audit plan – percentage completed at year end >85% Quality of audit work – overall client satisfaction >90% Outcomes from audit work – value to the organisation >90% 2.18 The Internal Audit Charter is a formal document which defines the internal audit activity’s purpose, authority and position. The Senior Manager reviews the Internal Audit Charter on an annual basis and presents any changes to the Audit and Scrutiny Committee for approval. In March 2025, the Audit & Scrutiny Committee approved the changes to the Internal Charter to ensure alignment with the requirements of the GIAS. 3. Proposals 3.1 It is proposed that the Committee approves the Internal Audit plan for 2026/27.
Page 5
OFFICIAL INFORMATION OFFICIAL INFORMATION 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 Consultation has taken place on an individual basis with the Executive Leadership Team during the preparation of the Internal Audit plan. Mark Boyd Head of Service (Finance)
Page 6
OFFICIAL INFORMATION OFFICIAL INFORMATION For further information please contact Paul Brown, Senior Manager (Audit, Fraud, Safety, Risk and Insurance), on paulbrown1@north-ayrshire.gov.uk. Background Papers None.
Page 7
OFFICIAL INFORMATION OFFICIAL INFORMATION Internal Audit Plan 2026/27 Quarters 1 & 2 Appendix A Audit Area to Deliver in Plan Directorate/Service Planned Quarter Priority Link to Council Plan Link to Risk Registers Grants Compliance Communities & Housing Q1 B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk General Ledger Finance Q2 B n/a n/a Accounts Payable Transactions People & ICT Q2 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities n/a ICT – Incident Detection People & ICT Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk School Inventory Management Education Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities n/a Neighbourhood Services – Overtime Place Q1 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Absence Management (specifically EDU/HSCP) People & ICT Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people n/a Headstone Inspections Place Q1 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people n/a Business Continuity Planning HSCP Q2 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Corporate/Operational Risk Tenants and Residents Associations Communities & Housing Ongoing D Communities and Local Democracy – we will have active, inclusive and resilient communities n/a
Page 8
OFFICIAL INFORMATION OFFICIAL INFORMATION Rolling Internal Audit Plan Appendix B These reviews will form part of the rolling plan for 2026/27. The plan will continue to be adjusted as the year progresses to reflect current organisational risks and issues. Ongoing risk assessments will be undertaken to determine the priority areas to include in the plan. Potential Future Audit Areas Directorate/Service Priority Link to Council Plan Link to Risk Registers Corporate - Performance All B All N/A Corporate - Business Continuity Planning All C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk Stores Controls Communities & Housing C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Community Associations Communities & Housing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk ALEO Arrangements Communities & Housing C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Void Management (27/28 onwards) Communities & Housing C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Trading Standards Communities & Housing D Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Dampness & Mould Communities & Housing A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Housing Repairs (27/28 onwards) Communities & Housing / Place C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Tenant Safety (fire/gas) Communities & Housing / Place B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Freedom of Information/Subject Access Requests (27/28 onwards) Democratic A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate and Operational Risk Residential Placements Education B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Education - Handling of Medication Education B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A
Page 9
OFFICIAL INFORMATION OFFICIAL INFORMATION Management of Allergens in Schools Education B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk School Roll Forecasting Education C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Facilities Management Timesheet Processes Education C N/A N/A Placement Requests Education C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Community Based Support - Young People HSCP B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Financial Assessments - non- residential HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Commissioning – including supplier failure HSCP B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Review of HSCP Charging Policy HSCP C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Implementation of new Social Work System HSCP B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Transitioning Arrangements (27/28 onwards) HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Coming Home Agenda (27/28 onwards) HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Integration Joint Board Audit Days IJB A N/A N/A Payroll Transaction Testing People & ICT A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Agency Staff & Workers (IR35) People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A ICT – Network Security People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Council Tax – Second Homes Finance/People &ICT C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A
Page 10
OFFICIAL INFORMATION OFFICIAL INFORMATION Contract Management/Monitoring Finance C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Artificial Intelligence & Governance All C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Fuel Controls Place B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Sustainability Climate Change (27/28 onwards) Place B Climate Change – achieving net-zero by 2030 Strategic Risk and Operational Risk Waste Management – Special Uplifts Place C Climate Change – achieving net-zero by 2030 Operational Risk Playpark/Tree Management/Street Furniture Inspection Arrangements Place B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Deposit Return Scheme (27/28 onwards) Place C Climate Change – achieving net-zero by 2030 Operational Risk Assets – Property Lifecycle Investment (27/28 onwards) Place B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic & Operational Risk Ayrshire Growth Deal Place A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Fire Safety Risk Management Place A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Local Growth Fund (27/28 onwards) Place C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk