7 - 2024 03 21 Internal Audit Plan 2024-25
North Ayrshire Council · 21 March 2024
Back to Audit and Scrutiny Committee — 21 March 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 21 March 2024 Audit and Scrutiny Committee Title: Internal Audit Plan 2024/25 Purpose: To inform the Committee of the proposed internal audit plan for 2024/25. Recommendation: That the Committee approves the internal audit plan for 2024/25. 1. Executive Summary 1.1 Internal Audit provides an independent and objective opinion on the Council’s risk management, governance and control environment by evaluating its effectiveness. This report presents the proposed internal audit plan for 2024/25. 1.2 Prior to the start of each financial year, internal audit in conjunction with senior management, put together a proposed plan of audit work. The objective of our planning process and subsequent plan is to put us in a position to provide a well- informed and comprehensive annual audit opinion, based on sufficient and appropriate coverage of key business objectives, associated risks, and risk management processes. 2. Background Internal Audit Plan 2024/25 2.1 The outcomes of each of the audits in our planned programme of work will provide senior management and Members with assurance that the current risks faced by the Council in these areas are adequately controlled and managed. 2.2 A number of factors are considered when putting together the risk based internal audit plan for 2024/25, including: • Consultation with senior management; • Review of the Council’s key objectives and Council Plan 2023-2028; • Review of the Council’s fundamental business processes and key services; • Review of the Council's current risk management framework, processes and risk management maturity; • Review of the key risks featuring in the Council's risk registers; • Internal Audit’s own risk assessment based on knowledge of the business and incorporating findings from previous internal audit work; and
Page 2
• Internal Audit’s awareness of emerging regional and national risk factors. 2.3 The approach to the delivery of the internal audit plan will be for it to remain flexible throughout the year to respond to new and emerging risks. 2024/25 will be the first year of the adoption of a new ‘rolling’ internal audit plan which will remain agile and can be reviewed and updated on a continual basis. To meet this need for increased flexibility, confirmed work will cover a maximum of a six month period with a rolling forward plan of possible areas for future consideration. Changes to the internal audit plan will be presented to the Committee for information through newly established quarterly progress reports. This approach is fully in line with the new global internal audit standards which require the audit plan to be risk-based and dynamic, reflecting timely adjustments in response to changes affecting the organisation. 2.4 Internal Audit has strong working relationships with all Council services, with services regularly requesting advice and insight from Internal Audit. It is important that the plan also continues to flex to allow for this work, which ensures Internal Audit advice is offered to services in a timely manner, when it will add the most significant value to the business needs. 2.5 The documented risk assessment is based on a risk universe which is maintained by internal audit but used to document the consultation which takes place between internal audit and senior management. Management are welcome to feed into the risk universe to help ensure it is updated on a continuous basis. The risk universe documents risk factors such as: • Links to the strategic priorities within the Council Plan for 2023-2028; • Links to strategic, corporate and operational risk registers; • Whether the auditable area is a source of significant risk; • Whether there is significant value to the Council in the audit being carried out; • known risk factors arising from local and national issues; and • risk factors arising from previous internal audit work and knowledge of the Council. 2.6 An overall conclusion is reached from an assessment of each risk area, which categorises audits into the following priorities: • Priority A – a ‘must do’ audit based on risk (very high risk); • Priority B – a ‘should do’ audit, time permitting (high risk); • Priority C – a ‘may do’ audit, time permitting (moderate risk); and • Priority D – an audit where the result would not be of sufficient value to the Council (low risk). 2.7 Examples of the key risk factors which have influenced the early part of the 2024/25 internal audit plan are as follows: • Transformation and change management is identified as a strategic risk for the Council. Internal audit will focus on the governance arrangements in place to take forward a programme of transformational change. • Climate change is highlighted not only as a strategic risk for the Council, but also recognised as a global risk. Internal audit will continue to be involved in work in this area in a consultancy capacity while the service develops appropriate measurements to demonstrate and track the route to net zero.
Page 3
• Cyber resilience is identified as a strategic risk for the Council. Added to this, most global risk literature continues to identify cyber security as the number one global risk. The Scottish Government’s cyber resilience framework is intended to support public sector organisations to develop and improve their cyber security arrangements. Internal audit will continue to base the next phase of cyber resilience audits on aspects of this framework. • Aids & Adaptations were subject to a detailed review in 2020/21. The service have implemented a number of new controls in response to the audit action plan, and a full review will be carried out to assess the effectiveness of the new controls. • Pupil Equity Funding (PEF) was originally scheduled for late 2023/24 but has been deferred to early 2024/25. This is a result of changes that the service has made to the year end reporting arrangements for PEF and a request to include that within the audit scope. • Agency staff and workers remains a high risk for the Council. There are financial risks of non-compliance with IR35 legislation. • Revised national guidance for child protection was updated in 2023 and sets out the responsibilities and expectations for all involved in protecting children. The guidance aims to support the care and protection of children, and therefore a review of compliance with the updated guidance is timely and of significant value. 2.8 The aim is to produce an agile, dynamic, risk-based internal audit plan containing key areas of coverage. The overall objective of the work of internal audit is to enable the Senior Manager to form an evidence based independent opinion at the end of the year on the adequacy of the Council’s internal control, risk and governance arrangements. This opinion forms part of the Annual Governance Statement for the year which is included within the Council’s financial statements. 2.9 The benefit of a rolling internal audit plan is to be able to continually update this as new areas of work are agreed. New audits are risk assessed and added to the rolling plan which may mean lower risk audits are delivered at a later date. If a new audit area arises which is of such significant risk, this could lead to previously agreed work being deferred. As noted above, any such changes will be presented back to the Committee for information through newly established quarterly reports. 2.10 Internal audit coverage can never be absolute, and responsibility for risk management, governance and internal control arrangements will always remain fully with management. As such, internal audit cannot provide complete assurance over any area, and equally cannot provide any guarantee against material errors, loss or fraud. 2.11 Appendix A contains the internal audit plan for quarters one and two of 2024/25. The plan will be added to throughout the year, with a list of potential audit areas provided at Appendix B. Audit titles and high level scopes are indicative at this stage for planning our resources. At the start of each audit, detailed planning will be carried out to agree the objectives and the scope of the work. The plan will therefore be subject to change throughout the year, depending on a number of factors such as available resources, time required to complete reviews, and unplanned work arising throughout the year. 2.12 The Senior Manager is required to ensure that internal audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. The Internal Audit Team currently comprises a Senior Manager, an Internal Audit Manager, two Internal Auditors and a Computer Auditor. All members of the team hold
Page 4
professional accountancy or audit qualifications and are suitably experienced. A known vacancy will arise in 2024/25 which may impact on the internal audit activity for the year. 2.13 In addition to the programme of audit work to be carried out, time is also required to be set aside throughout 2024/25 to support the following areas: • Consultancy – both ad hoc advice and project work • Follow up of prior year internal audit action points • Audit planning and monitoring • Committee attendance and reporting • Development of the internal audit service • Self-assessments and external quality assessments against PSIAS • Review of governance documents such as Codes of Financial Practice and the Annual Governance Statement. 2.14 A further fundamental development taking place during 2024/25 is the new global internal audit standards. These were released in January 2024, with full implementation due from January 2025. The changes to the global standards will have a knock-on effect on the PSIAS. The Internal Audit Standards Advisory Board (IASAB) will meet soon to discuss the impact on the PSIAS, with the aim of refreshing the standards for implementation at the same time as the global standards in January 2025. This will potentially mean changes to processes, procedures and working practices which will need to take priority during the year to ensure ongoing compliance with the PSIAS. The volume of work this may entail is currently unknown. Internal Audit Performance 2.15 As part of the new progress reporting regime, we will report on internal audit performance. The following targets will be used to measure the performance of the internal audit activity: Performance Measure Performance Target Delivery of internal audit plan – percentage completed at year end >85% Quality of audit work – overall client satisfaction >90% Outcomes from audit work – value to the organisation >90% Conformance with the Public Sector Internal Audit Standards (PSIAS) 2.16 The work of Internal Audit is governed by the requirements of the Public Sector Internal Audit Standards (PSIAS) 2017. The standards, issued jointly by the Chartered Institute of Public Finance & Accountancy (CIPFA) and the Chartered Institute of Internal Auditors (IIA), require the Senior Manager (Audit, Fraud, Safety & Risk) to establish a risk-based internal audit plan to determine the priorities of the internal audit activity, consistent with the Council’s goals and objectives. 2.17 Every five years, Internal Audit is subject to an External Quality Assessment (EQA) covering the activity of the service. The last of these was carried out in July 2022, and reported to the Committee in September 2022. The assessment confirmed conformance with the PSIAS. A regular self-assessment process confirms ongoing compliance.
Page 5
2.18 The Internal Audit Charter is a formal document which defines the internal audit activity’s purpose, authority and position. The Senior Manager reviews the Internal Audit Charter on an annual basis and presents any changes to the Audit and Scrutiny Committee for approval. The Internal Audit Charter has been reviewed and there are no material changes identified at this time. It is likely that a refreshed Internal Audit Charter will be required in March 2025, to take account of the new internal audit standards. 3. Proposals 3.1 It is proposed that the Committee approves the Internal Audit plan for 2024/25. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 Consultation has taken place on an individual basis with the Executive Leadership Team during the preparation of the Internal Audit plan. Mark Boyd Head of Service (Finance)
Page 6
For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 7
Internal Audit Plan 2024/25 Quarters 1 & 2 Appendix A Audit Area to Deliver in Plan Directorate/Service Planned Quarter Priority Link to Council Plan Link to Risk Registers Transformation and Change Management Corporate Q1 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk ICT - Environmental and Physical Security People & ICT Q1 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk ICT - Access Control People & ICT Q1 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Aids & Adaptations HSCP Q1 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Pupil Equity Funding Education Q1 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Accounts Payable Transaction Testing Finance Q1/Q2 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A ICT - Information Security Management People & ICT Q2 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Locality Planning Communities & Housing Q2 B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Community Care store HSCP Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Agency Staff & Workers People & ICT Q2 A N/A N/A Child Protection HSCP Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Tenants & Residents Associations Communities & Housing Ongoing D Communities and Local Democracy – we will have active, inclusive and resilient communities N/A Consultancy - Sustainability & Climate Change Place Ongoing A Climate Change – achieving net-zero by 2030 Strategic Risk Consultancy - Waste Review Place Ongoing B Climate Change – achieving net-zero by 2030 N/A
Page 8
Rolling Internal Audit Plan Appendix B Potential Future Audit Areas Directorate/Service Priority Link to Council Plan Link to Risk Registers Corporate Performance All B All N/A Advisory - Equalities Democratic B N/A Strategic Risk Freedom of Information Democratic A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk Capital Monitoring Finance B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Health & Safety Finance C N/A N/A Absence Management People & ICT A N/A N/A Community Based Support - Young People HSCP B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Procurement Finance B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Payroll Transaction Testing People & ICT A N/A N/A Income Collection Finance A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Care Homes - sustainability HSCP B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk ICT - Asset Management People & ICT A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Fuel Controls Place B N/A N/A Overtime Controls in Streetscene Place B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Flood Programme Place B Climate Change – achieving net-zero by 2030 Strategic Risk and Operational Risk Advisory - Decriminalised Parking Arrangements Place C N/A N/A Ayrshire Growth Deal Place A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Homelessness Communities & Housing A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Financial Assessments - non-residential HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Overtime controls in HSCP HSCP B N/A N/A Social Care Establishments HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Integration Joint Board Audit Days IJB A N/A N/A Shared Prosperity Fund Place C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Community Associations Communities & Housing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Stores Controls Communities & Housing C N/A N/A These reviews will form part of the rolling plan for 2024/25. The plan will continue to be adjusted as the year progresses to reflect current organisational risks and issues. Ongoing risk assessments will be undertaken to determine the priority areas to include in the plan.