Internal Audit Annual Report 202526
North Ayrshire Council · 4 June 2026
Back to Audit and Scrutiny Committee — 4 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 4 June 2026 Audit and Scrutiny Committee Title: Internal Audit Annual Report 2025/26 Purpose: To provide the Committee with an annual report on the work of Internal Audit during 2025/26 and provide an opinion on the governance, risk management and internal control environment of the Council. Recommendation: The Committee is asked to note the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 1. Executive Summary 1.1 The purpose of this report is to present the annual report on the internal audit activity during 2025/26, and to provide an independent opinion on the adequacy and effectiveness of the Council’s governance, risk management and internal control systems for the year ended 31 March 2026. 2. Background 2.1 The Global Internal Audit Standards (GIAS) came into effect from April 2025, replacing the Public Sector Internal Audit Standards (PSIAS). As with the previous standards, GIAS require that the Chief Internal Auditor prepare an annual report on the internal audit activity for the year, including an overall opinion on the adequacy of the Council’s governance, risk management and internal control arrangements. The Annual Internal Audit Report for 2025/26 is attached at Appendix 1. The report sets out the role and performance of Internal Audit during the year, summarises key audit findings, and concludes with the annual internal audit opinion. 2.2 The Internal Audit Plan for 2025/26 was approved by the Committee in March 2025 and set out the audits planned for the first two quarters of the financial year. In November 2025, the Committee approved the audits scheduled for the final two quarters of the year. 2.3 The Internal Audit Plan for 2025/26 has been completed, with sufficient coverage achieved to support the provision of the annual internal audit opinion contained within the Annual Report. The opinion is informed by the risks and findings identified during the year, together with the assurance levels arising from individual audit assignments. In forming the annual opinion, consideration is also given to wider factors, including the Council’s risk management arrangements and the overall control environment. 2.4 The Annual Governance Statement for 2025/26 is reported as part of the Council’s Annual Accounts. The Annual Internal Audit Report and the associated audit opinion
Page 2
presented in this paper provide key assurance inputs to the Annual Governance Statement. 2.5 Based on the work undertaken by the Internal Audit team during 2025/26, the Chief Internal Auditor’s opinion is that reasonable assurance can be provided on the adequacy and effectiveness of the Council’s governance, risk management and control arrangements. 3. Proposals 3.1 It is proposed that the Committee notes the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None United Nations Rights of the Child (UNCRC) 4.9 None
Page 3
Consumer Duty 4.10 None 5. Consultation 5.1 Council Services are consulted on the findings of Internal Audit throughout the year. No specific consultations have taken place in relation to this annual report. Mark Boyd Head of Service (Finance) For further information please contact Paul Brown, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324360. Background Papers None.
Page 4
Appendix 1 INTERNAL AUDIT ANNUAL REPORT 2025/26 1. Introduction 1.1. The purpose of this report is to summarise the Internal Audit activity undertaken during 2025/26 and to provide the Chief Internal Auditor’s opinion on the overall adequacy and effectiveness of the Council’s governance, risk management and internal control frameworks. 1.2. The Council’s Section 95 Officer has overall responsibility for Internal Audit in North Ayrshire Council. The Senior Manager (Audit, Fraud, Safety, Risk & Insurance) reports to the Section 95 Officer, with the right of access to the Chief Executive and the Chair of the Audit and Scrutiny Committee on any audit matter. These rights of access help ensure the organisational independence of Internal Audit and are a key part of the Internal Audit Charter, approved by the Committee in March 2025. 1.3. In accordance with the Global Internal Audit Standards the Chief Internal Auditor can confirm that the Internal Audit function maintained its organisational independence during the year, with no impairments occurring during this period. 1.4. The presence of an effective Internal Audit function contributes to, but does not substitute for, effective internal control. Responsibility for establishing and maintaining an adequate system of internal control rests with management, including monitoring controls to ensure they continue to operate effectively. A sound system of internal control helps to safeguard assets, support the reliability of records, enhance operational efficiency, and ensure compliance with key policies and procedures. However, such a system can only provide reasonable, and not absolute, assurance against the risk of loss or failure. 2. Global Internal Audit Standards (GIAS) 2.1. From 1 April the Internal Audit Team are required to work to the Global Internal Audit Standards (GIAS), replacing the Public Sector Internal Audit Standards (PSIAS). In accordance with Section 7(1) of the Local Authority Accounts (Scotland) Regulations 2014, the Council are required to operate a professional and objective internal audit service in accordance with recognised standards which are defined as those of the GIAS. 2.2. A self-assessment against the Global Internal Audit Standards has been completed, and the Chief Internal Auditor has concluded that the internal audit function generally conforms with the Standards. An associated action plan has been developed and will be implemented over the next 12 months to support progression towards full conformance. Progress against this action plan will be reported to the Audit & Scrutiny Committee during 2026/27. This self-assessment forms part of the Quality Assurance and Improvement Programme (QAIP), as required by the Global Internal Audit Standards. 2.3. Improvements and enhancements to support progression to full conformance, to be taken forward during 2026/27, include the development of an Internal Audit Strategy, a review of the Internal Audit Manual and associated templates, enhancement of assurance mapping arrangements, and the formalisation of root cause analysis.
Page 5
2.4. Internal Audit operates in accordance with the Internal Audit Charter, most recently approved by the Audit and Scrutiny Committee in March 2025, which establishes the purpose, authority and responsibility of the Internal Audit function in line with the Global Internal Audit Standards (GIAS). The Charter incorporates the Internal Audit Mandate, defining the scope of Internal Audit’s work and providing the authority to deliver independent and objective assurance and advisory services across the Council. 2.5. The Senior Manager reports functionally to the Audit & Scrutiny Committee, with unrestricted access to the Chief Executive and the Committee. 2.6. In accordance with the GIAS, the Internal Audit function is required to undergo an External Quality Assessment (EQA) at least once every five years. The most recent EQA was completed in 2022, and the next EQA—undertaken against the new Global Internal Audit Standards—is scheduled for 2027.
Page 6
3. Planned and Actual Activity during 2025/26 3.1. The Internal Audit Plan was approved by the Audit and Scrutiny Committee in March 2025, with a mid-year update approved in November 2025. The Plan allocates time for the delivery of audit assignments identified through the audit planning process. This is complemented by provision for other activities, including audit management, strategic development of the service, staff training and development, and the undertaking of ad-hoc work, including investigations and in-year requests from services. 3.2. Taking account of both the original plan approved in March 2025 and the mid-year update approved in November 2025, the Internal Audit Plan for 2025/26 comprised a total of 20 audit assignments. At the time of preparation of this Annual Internal Audit Report, 10 assignments had been completed (either reported on or at reporting stage), fieldwork was underway for a further four audits, and the remaining six audits have been deferred and included within the 2026/27 Internal Audit Plan, which was reported to the Audit & Scrutiny Committee in March 2026. A further audit, whilst not on the 2025/26 Audit Plan, was also completed and is at the reporting stage. 3.3. Of the four audits where fieldwork is currently ongoing, three relate to Council services and one relates to the North Ayrshire Integrated Joint Board (IJB). 3.4. The six audit assignments that were carried forward and included in the 2026/27 audit plan were reported to the Committee in March 2026. These audits comprise Absence Management, Grants Compliance, School Inventory Management, HSCP Business Continuity Management, ICT Incident Detection and Neighbourhood Services - Overtime. The outcomes of these audits, including the associated assurance levels, will be reported to future meetings of the Audit & Scrutiny Committee. 3.5. In accordance with the Council’s defalcation procedures, all suspected instances of suspected fraud and irregularity are required to be reported to Internal Audit. These are investigated by the specialist Corporate Fraud Team and are not included within this annual report. 3.6. All audit reports finalised during 2025/26 were reported to meetings of the Audit and Scrutiny Committee. A summary of outputs achieved are included in Annex A 3.7. The results of the audits that have been completed and reported on, with respect to the 2025/26 audit plan, have been positive with substantial and reasonable audit opinions reported upon. 3.8. Key positives arising from the audit work undertaken during 2025/26 include the reasonable assurance opinions provided in relation to both Payroll and Accounts Payable Transactional Testing. These are areas of significant inherent financial risk and given that the Accounts Payable audit received a limited assurance opinion in the 2024/25 Annual Internal Audit Report, this represents a marked improvement. In addition, the reasonable assurance opinion provided for the Council Tax and Non-Domestic Rates (NDR) Refund audit—undertaken with reference to a fraud identified in another local authority—provides assurance that risks within this area are being effectively managed. 3.9. These findings, together with the results of other audit work undertaken during the year and the individual assurance levels assigned, have informed the annual
Page 7
internal audit opinion set out at Annex B of this report. 4. Audit Resources 4.1. The Internal Audit section is directly managed by the Team Manager (Internal Audit), who reports to the Senior Manager (Audit, Fraud, Safety, Risk & Insurance). The Senior Manager is responsible for Internal Audit, as well as Corporate Fraud, Risk and Insurance and Corporate Health and Safety. 4.2. In addition to the Team Manager, the Internal Audit team comprised two part-time Internal Auditors and a part-time Computer Auditor. The previous Senior Manager left their post in October 2025, resulting in a short vacancy period until November 2025. 4.3. All staff within the Internal Audit section hold a relevant qualification, either through an institute which is part of the Consultative Committee of Accountancy Bodies (CCAB) or the Institute of Internal Auditors (IIA). 4.4. The Internal Audit Charter requires the Senior Manager to report to the Section 95 Officer and the Audit and Scrutiny Committee if resources available fall below an acceptable level for the audit work required. No material instances of resource limitation have occurred during 2025/26. 5. Performance 5.1. During 2025/26, Internal Audit provided regular updates to the Audit and Scrutiny Committee on the activities of the service. Elected Members had the opportunity to discuss all Internal Audit reports and question either the Senior Manager or relevant officers from Council services. Elected Member training was provided to the Committee in May 2022, with individual training made available to new members joining the Committee during the year. 5.2. The Council’s performance management system, Pentana, is used to monitor progress against agreed audit action plans. Officers responsible for implementing audit actions are required to update the system, with progress reports provided to the Audit and Scrutiny Committee on a quarterly basis. Where actions are overdue, responsible officers are required to attend meetings of the Committee to update Elected Members on the actions being taken to ensure implementation. 5.3. The 2025/26 financial year is the first year in which compliance with the Global Internal Audit Standards (GIAS) is required. These standards came into effect in April 2025, replacing the previous Public Sector Internal Audit Standards (PSIAS). As with PSIAS, GIAS require an External Quality Assessment (EQA) to be undertaken at least once every five years. The most recent EQA was completed in 2022 against PSIAS and provided a positive assessment, concluding that the internal audit activity was fully conformant with 13 of the 14 standards and generally conformant with the remaining standard. The next EQA, to be undertaken against GIAS, is scheduled for 2027 and will continue to be delivered through the peer-to-peer review arrangements of the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG). 5.4. The Senior Manager undertook an initial self-assessment of the Internal Audit service’s conformance with the Global Internal Audit Standards (GIAS). The outcome
Page 8
of this assessment concluded that the service generally conforms with the Standards. To support progression to full conformance, an action plan will be developed based on the results of the self-assessment. This action plan will be reported to the Audit & Scrutiny Committee during 2026/27, in advance of the External Quality Assessment scheduled for 2027. 5.5. Internal Audit maintains a strong working relationship with Council services and is frequently asked to provide audit advice on an ad-hoc basis. While the volume of such requests is outside the direct control of Internal Audit, it is important that the service responds where possible, as this supports timely advice and helps to maximise organisational value. During 2025/26, Internal Audit responded to 25 requests for advisory support and 2 investigations. In addition, Internal Audit is represented on the Project Boards of several corporate and cross-Council working groups, which are detailed in Annex A. This work is advisory in nature and therefore does not result in formal assurance reports being presented to the Audit & Scrutiny Committee; however, it represents a key component of the value-adding role of the Internal Audit service. 5.6. As part of the monitoring arrangements the following targets were used to measure the performance of the internal audit activity. Performance Measure Performance Target Result Delivery of internal audit plan – percentage completed at year end >85% 57% Quality of audit work – overall client satisfaction >90% 100% Outcomes from audit work – value to the organisation >90% 100% 5.7 Performance against the 2025/26 Audit Plan delivery indicator was below target for the year. The primary contributory factor was the time required during 2025/26 to complete elements of the previous year’s audit plan. 5.8 As part of the development of the 2026/27 Audit Plan, the Chief Internal Auditor, following discussion with management, has carried forward these audit assignments into the 2026/27 plan. It is anticipated that this approach will support closer alignment with the delivery target in 2026/27. 5.9 Notwithstanding the delivery target not being met, sufficient appropriate evidence was obtained to support the annual audit opinion. This was achieved through the prioritisation of audit activity and consideration of audits that, while not yet formally reported to Committee, were sufficiently progressed during the year. 6. Other Responsibilities 6.1. The Senior Manager is also the Chief Internal Auditor for the NAIJB. In the interests of information sharing, the results of the NAIJB audit work are shared with the Audit and Scrutiny Committee. 7. Opinion 7.1. There is a formal requirement for the Chief Internal Auditor to prepare an assurance statement on the adequacy of internal control systems within the Council. The internal
Page 9
audit annual statement on the adequacy of internal controls is included in Annex B. 8. Conclusion 8.1. The Internal Audit Plan for 2025/26 has been completed to a level sufficient to support the provision of the annual internal audit opinion. No limitations of scope apply to the opinion issued.
Page 10
Summary of Internal Audit Work 2025/26 Annex A Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total COMPLETED WORK Assurance Procurement * Substantial 28 August 2025 0 1 0 1 Assurance Locality Planning – Community Investment Fund*** Reasonable 28 August 2025 1 5 0 6 Assurance Housing Indicators *** Reasonable/Limited 20 November 2025 3 0 2 5 Assurance IJB Transformation * Substantial 20 November 2025 0 0 1 1 Assurance HSCP – Overtime Controls Reasonable 20 November 2025 0 4 0 4 Assurance HSCP – Child Protection * Substantial 20 November 2025 0 1 0 1 Assurance Accounts Payable Transaction Testing Reasonable 20 November 2025 3 3 0 6 Assurance Council Tax and NDR Refunds Reasonable 29 January 2026 0 3 1 4 Assurance Homelessness * Substantial 29 January 2026 0 0 0 0 Assurance Income Collection * Reasonable 29 January 2026 0 0 0 0 Assurance School Funds Substantial 12 March 2026 0 1 0 1 Assurance Capital Monitoring Substantial 4 June 2026 0 1 0 1 Assurance Payroll Transaction Testing Reasonable 4 June 2026 0 0 4 4 Assurance Buildings and Estate Management Reasonable 4 June 2026 1 3 0 4 Consultancy Grants Compliance n/a n/a n/a n/a n/a n/a Annual Accounts Tenants and Residents Associations n/a n/a n/a n/a n/a n/a REPORTING PHASE** Assurance Payments to Partnership Nurseries Substantial tbc tbc tbc tbc tbc Assurance Information Security Management**** tbc tbc tbc tbc tbc tbc WORK IN PROGRESS Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total Assurance ICT Asset Management tbc tbc tbc tbc tbc tbc
Page 11
Summary of Internal Audit Work 2025/26 Annex A Assurance Social Care Establishments tbc tbc tbc tbc tbc tbc Assurance Neighbourhood Services - Overtime tbc tbc tbc tbc tbc tbc Assurance Ayrshire Growth Deal tbc tbc tbc tbc tbc tbc Assurance IJB Financial Sustainability tbc tbc tbc tbc tbc tbc NOT STARTED Assurance Absence Management tbc tbc tbc tbc tbc tbc Assurance Grants Compliance tbc tbc tbc tbc tbc tbc Assurance School Inventory Management tbc tbc tbc tbc tbc tbc Assurance HSCP Business Continuity Management tbc tbc tbc Tbc tbc tbc Assurance ICT Incident Detection tbc tbc Tbc tbc Tbc tbc OTHER/ONGOING Consultancy O365/Information and Collaboration Project Board Not Applicable: These assignments are for the provision of advice and guidance and therefore do not result in an assurance report being brought to the Committee. Consultancy Artificial Intelligence Working Group Consultancy CRM Project Board, Including Employee Account Project Consultancy Corporate Telephony Project Board Consultancy Architecture Board Consultancy Connected Communities – Grant Funds Procedure Review Investigations 2 Small Advisory 25 various requests * 2024/25 audit but not sufficiently concluded at the time of the 2024/25 annual report, therefore opinion included in 2025/26. ** Audits not yet finalised but sufficiently in draft to conclude on the level of assurance. *** Whilst reported in the 2025/26 financial year these audits were at the reporting stage at the time of the 2024/25 Annual Audit Report and formed part of the 2024/25 annual audit opinion. Noted here for reporting visibility purposes but excluded from the 2025/26 annual audit opinion. **** Was not Included on the 2025/26 Audit Plan but work performed in 2025/26
Page 12
Annex B Internal Audit Annual Statement on the Adequacy of Internal Controls To the Members and Chief Executive of North Ayrshire Council As Chief Internal Auditor for North Ayrshire Council, I am pleased to present my annual statement on the overall adequacy and effectiveness of the framework of governance, risk management and control of the Council for the year ended 31 March 2026. Respective responsibilities of management and internal auditors in relation to governance, risk management and control It is the responsibility of the Council’s senior management to determine, establish and maintain sound systems of governance, risk management and control to ensure that the organisation’s resources are properly applied in a manner and on the activities intended and that these arrangements are sufficient to address the risks facing their services. This includes responsibility for the prevention and detection of fraud. Management is also charged with monitoring the continuing effectiveness of these arrangements and taking action as appropriate. It is the responsibility of the Chief Internal Auditor to provide an annual assessment of the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control. Sound internal controls The main objectives of the Council’s internal control systems are to: • ensure adherence to management policies and directives in order to achieve the organisation’s objectives; • safeguard assets; • ensure the relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records; and • ensure compliance with statutory requirements. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control. The work of internal audit Internal Audit is an independent and objective assurance and consulting activity designed to add value and improve the Council’s operations. It supports the achievement of organisational objectives through a systematic, disciplined approach to evaluating and improving the effectiveness of governance, risk management and internal control processes. The Global Internal Audit Standards (GIAS) came into effect on 1 April 2025. The Chief Internal Auditor has undertaken a self-assessment against these Standards and concluded that the Internal Audit service generally conforms with GIAS, the CIPFA Application Note, and the CIPFA Code of Practice for the Governance of Internal Audit in UK Local Government. An associated action plan has been developed and will be progressed, and reported upon, during 2026/27 to address areas for improvement and achieve full conformance with the Standards. This action plan also forms the basis of the Internal Audit service’s Quality Assurance & Improvement Action Program (QAIP)
Page 13
Annex B The Chief Internal Auditor prepares an annual internal audit plan which outlines the programme of work to be undertaken. The plan is developed utilising a risk-based methodology and considers the requirement placed upon the Chief Internal Auditor to deliver an annual internal audit opinion. The plan needs to be flexible to reflect the changing risks and priorities of the organisation. The plan, and any material changes to the plan during the year, are approved by the Audit and Scrutiny Committee. All internal audit reports are brought to the attention of management, including system weaknesses and/or non-compliance with expected controls, together with agreed action plans. It is management’s responsibility to ensure that due consideration is given to internal audit reports and that appropriate action is taken on audit recommendations. This includes management taking remedial action where appropriate or accepting that there may be a level of risk exposure if the weaknesses identified are not addressed for operational reasons. Internal Audit is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. Matters arising from internal audit work are also reported to the Chief Executive, Head of Finance (as Section 95 Officer), Members of the Audit and Scrutiny Committee, and external audit. Summary of Internal Audit Activity 2025/26 A total of 12 Internal Audit reports, excluding two that formed part of the 2024/25 annual audit report, were reported to the Audit & Scrutiny Committee and contribute to the 2025/26 annual audit opinion. A further two audit assignments, while not yet reported to Committee, had progressed sufficiently to be considered in forming the annual opinion. In total, 14 audit assignments have therefore been taken into account. Of the 12 audit opinions reported to Committee, six provided substantial assurance and six provided reasonable assurance. A diverse range of audit areas was covered during the year. In addition to planned audit assignments, Internal Audit provides advice and guidance on the Council’s control environment as required and undertakes non-fraud investigations that are brought to our attention. A range of recommendations have been raised in the areas covered by the 2025/26 internal audit plan. Many expected key controls have been in place and operating effectively, however Internal Audit has also identified scope for improvement in some systems. All 38 action points reported in the year have been accepted by management and will result in continued improvement of the Council’s governance, risk management and control environment. Impairments or Restriction of Scope There have been no impairments or restrictions of scope during the course of the year.
Page 14
Annex B Basis of Opinion This conclusion is made with reference to the Council’s established governance, risk management and internal control frameworks and the requirements of the Global Internal Audit Standards. The evaluation of the control environment is informed by several sources: • the audit work undertaken by Internal Audit during the year to 31 March 2026; • the audit work undertaken by Internal Audit in previous years and knowledge of any significant audit findings after the year end; • the assessment of risk completed during the preparation of the annual audit plan; • reports issued by the Council’s external auditors and other review and inspection agencies, though no formal reliance is placed on these for the purposes of this conclusion; • knowledge of the Council’s governance, risk management and performance monitoring arrangements; and • any other items brought to the attention of internal audit by whatever means which may warrant further investigation. Opinion On the above basis, Internal Audit can provide reasonable assurance over the framework of governance, risk management and control and that adequate controls were in place and were operating throughout the Council in 2025/26. Paul Brown FCCA, CIA Senior Manager (Audit, Fraud, Safety, Risk & Insurance) 4 June 2026
Page 15
Annex B