8. (04) 2025 03 13 Internal Audit Charter 2025

North Ayrshire Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda

Text extracted from the council's PDF. Layout and reading order may differ from the original.

Original council PDF · Download plain text

Page 1

PUBLIC INFORMATION PUBLIC INFORMATION
PUBLIC INFORMATION PUBLIC INFORMATION 
NORTH AYRSHIRE COUNCIL 
13 March 2025 
Audit and Scrutiny Committee
Title: Internal Audit Charter 2025
Purpose: To seek Committee approval of the updated Internal Audit
Charter.
Recommendation: That the Committee: 
(a) notes the changes in Internal Audit standards and that the
requirements have been incorporated into the Internal Audit
Charter where necessary, 
(b) notes the inclusion of the Integrated Joint Board within the
scope of the Internal Audit Charter, 
(c) approves the Internal Audit Charter attached at Appendix
A, and 
(d) agrees that future amendments to the Charter will be
made where a need is identified. 
1. Executive Summary 
1.1 Internal Audit currently operates in accordance with the requirements of the
'Public Sector Internal Audit Standards (PSIAS)'. The Standards are
designed to ensure that common practices are followed across all public
sector bodies. 
1.2 One requirement of the PSIAS is the preparation of an 'Internal Audit Charter'
which must be approved by the Audit and Scrutiny Committee.
1.3 The PSIAS is changing, with the newly launched Global Internal Audit
Standards (GIAS) coming into effect within the UK Public Sector from 1 April
2025.
1.4 The authority for setting professional standards for internal audit in the UK
public sector rests with the Relevant Internal Audit Standard Setters
(RIASS). The RIASS have determined that the GIAS, issued by the Institute
for Internal Auditors (IIA), are a suitable basis for the practice of internal
auditing in the UK public sector, subject to interpretations and requirements
set out in the Application Note “Global Internal Audit Standards in the UK
Public Sector”. For UK Local Authorities, the Code of Practice on the
Governance of Internal Audit should also be used to interpret some of the
essential conditions in the new standards.
1.5 In May 2014 it was agreed that the Charter would be reviewed on a biennial
basis or at any other time if required by a material change to the terms of the
Charter.  The changes to internal audit standards and their impact on the

Page 2

PUBLIC INFORMATION PUBLIC INFORMATION
PUBLIC INFORMATION PUBLIC INFORMATION
Charter constitutes a material change which therefore requires Committee
approval.
1.6 The existing Internal Audit Charter was approved by the Audit and Scrutiny
Committee in March 2023. A revised Charter, which incorporates the relevant
requirements of the GIAS and UK public sector considerations, is attached at
Appendix A for approval. 
2. Background
2.1 The Charter is a formal document that defines the purpose, authority and
responsibility of Internal Audit; the section's position within the organisation;
authorises access to records, personnel and physical properties relevant to
the performance of audit engagements; and defines the scope of Internal
Audit activities.
2.2 It was previously agreed by the former Audit Committee that the Charter
should be reviewed on a biennial basis to ensure it remains current and
brought to Committee for approval. That has since been superseded and the
Senior Manager now conducts an annual review of the Charter to ensure
compliance with the internal audit standards. However only where material
changes occur would this result in a change to the Charter and require
reapproval by Committee. Examples of such circumstances would include:
changes to internal structures or arrangements, findings from an internal or
external quality assessment, or changes to the standards or guidance
around internal audit charters or the requirements of internal audit.
2.3 In preparation for the upcoming changes to the internal audit standards the
Internal Audit Charter has therefore been reviewed and updated to reflect
the new requirements. A number of more minor updates have also been
made to the Charter. 
2.4 Key changes to the Charter include:
• Amended references throughout the Charter from PSIAS to GIAS;
• The explicit inclusion of the internal audit mandate, which specifies the
authority, role and responsibilities of the Internal Audit function; 
• The inclusion of the North Ayrshire Integration Joint Board (IJB) within
the scope of the internal audit function’s activities.
3. Proposals 
3.1 It is proposed that the Committee (a) notes the changes in Internal Audit
standards and that the requirements have been incorporated into the Internal
Audit Charter where necessary, (b) notes the inclusion of the Integrated Joint
Board within the scope of the Internal Audit Charter, (c) approves the Internal
Audit Charter attached at Appendix A and (d) agrees that future amendments
to the Charter will be made where a need is identified.

Page 3

PUBLIC INFORMATION PUBLIC INFORMATION
PUBLIC INFORMATION PUBLIC INFORMATION 
4. Implications/Socio-economic Duty
Financial
4.1 None. 
Human Resources 
4.2 None. 
Legal 
4.3 None. 
Equality/Socio-economic 
4.4 None. 
Climate Change and Carbon 
4.5 None. 
Key Priorities 
4.6 The work of Internal Audit helps to support the efficient delivery of the strategic
priorities within the Council Plan 2023-2028. 
Community Wealth Building 
4.7 None. 
5. Consultation 
5.1 No consultations have been required in the preparation of this report. 
Mark Boyd
Head of Service (Finance) 
For further information please contact John McCallum, Senior Manager (Audit,
Fraud, Safety, Risk & Insurance), on 01294 324607. 
Background Papers
None.

Page 4

PUBLIC INFORMATION  Appendix A 
PUBLIC INFORMATION 
Internal Audit Charter
2025 
Version: Final
Date: 13/03/2025
Author: John McCallum
Classification: Public

Page 5

PUBLIC INFORMATION
PUBLIC INFORMATION 
INTERNAL AUDIT CHARTER 
2025 
1. Introduction 
1.1 North Ayrshire Council has adopted the definition of Internal Audit as given in the
Global Internal Audit Standards (GIAS):
‘Internal Auditing is an independent, objective assurance and consulting activity
designed to add value and improve an organisation’s operations. It helps an
organisation accomplish its objectives by bringing a systematic, disciplined
approach to evaluate and improve the effectiveness of risk management, control
and governance processes.’
1.2 GIAS requires the Council to define its interpretation of the generic terms ‘Chief
Audit Executive’, ‘Senior Management’ and ‘Board’. 
1.3 For the purposes of this Internal Audit Charter, the role of the ‘Chief Audit Executive’
is fulfilled by the Senior Manager (Audit, Fraud, Safety, Risk & Insurance), hereafter
referred to as the Senior Manager; the Chief Officers are defined as ‘Senior
Management’ and the ‘Board’ is deemed to be the Audit and Scrutiny Committee. 
1.4 The Senior Manager also fulfils the role of Chief Audit Executive for the North
Ayrshire Integration Joint Board (IJB) and whilst some terminology may differ
throughout, this Charter is also applicable to the IJB. 
2. Mandate, Purpose and Responsibilities of Internal Audit 
2.1 The mandate sets out the authority, roles and responsibilities, and empowers the
Internal Audit function to deliver on its purpose which is set out in paragraph 2.3
below. 
2.2 The authority for Internal Audit is derived from the Local Authority Accounts
(Scotland) Regulations 2014 which requires that “A local authority must operate a
professional and objective Internal Auditing service in accordance with recognised
standards and practices in relation to Internal Auditing.” 
2.3 In line with the GIAS, the purpose and mission of internal audit is to strengthen the
Council’s ability to create, protect and sustain value by providing the Council and
management with independent, risk-based and objective assurance, advice, insight
and foresight.

Page 6

PUBLIC INFORMATION
PUBLIC INFORMATION
2.4 The scope of Internal Audit activity includes, but is not limited to, the examination
and evaluation of the adequacy and effectiveness of the organisation’s governance,
risk management and internal control processes. This enables Internal Audit to
provide the Audit and Scrutiny Committee with assurance on the adequacy of these
arrangements. 
2.5 Internal Audit does this by:
• Providing high quality, independent audit services to the Council and its Senior
Management;
• Maintaining professional objectivity in all aspects of internal audit services;
• Performing a systematic and continuous review of the Council’s internal control,
risk management and governance arrangements in accordance with a risk-
based annual plan approved by the Audit and Scrutiny Committee;
• Highlighting opportunities to reduce costs through greater economy, efficiency
and effectiveness within existing internal controls throughout the Council’s
systems and activities;
• Advising on cost effective controls for new systems and activities;
• Providing an assurance statement and annual report to the Audit and Scrutiny
Committee on the adequacy of the Council’s internal control and governance
arrangements. 
2.6 Internal Audit is responsible for reporting risk exposures and control risks to the
Audit and Scrutiny Committee and Senior Management. 
2.7 Internal Audit will consult with the Council’s external auditor and with other relevant
inspection and review bodies in order to co-ordinate effort and avoid duplication. 
3. Standards and Ethics 
3.1 Internal Audit will carry out its work in accordance with:
• Relevant standards and guidelines issued by the Chartered Institute of Public
Finance and Accountancy (CIPFA) and the Institute of Internal Auditors (IIA);
• The Council’s ‘Local Code of Corporate Governance’;
• The section’s own Internal Audit Manual and Procedures. 
3.2 In particular, Internal Audit will adhere to the Global Internal Audit Standards (GIAS)
which were issued by the IIA in January 2024 and amended for use within the UK
Public Sector from 1 April 2025. The GIAS incorporates the mandatory elements of
the IIA’s International Professional Practices Framework – the definition of Internal
Auditing (see 1.1 above), the Code of Ethics and the International Standards for the
Professional Practice of Internal Auditing.

Page 7

PUBLIC INFORMATION
PUBLIC INFORMATION
3.3 Internal Auditors will comply with appropriate professional ethics at all times. These
cover:
• Integrity;
• Objectivity;
• Confidentiality;
• Competency. 
3.4 The Chief Audit Executive will hold a relevant professional qualification and will be
suitably experienced. Audit staff will adhere to the requirements of the Council’s
Employee Code of Conduct, the Seven Principles of Public Life and the ethical
standards of any professional institute of which they may be a member. Staff will
undertake Continuing Professional Development (CPD) as required and will also
keep their skills and knowledge current through appropriate professional learning
and the Council’s employee development programme. 
4. Position of Internal Audit within the Council 
4.1 Internal Audit is an independent activity. It is not an extension of, or a substitute for,
the functions of line management and must remain free from any undue influence or
other pressure affecting its actions and reporting. 
4.2 At all times, the responsibilities of Senior Management across the Council include:
• Maintaining proper internal controls in all processes for which they have
responsibility to ensure probity in systems and operations;
• Preventing and detecting fraud and irregularities within their service areas and
reporting any suspicions to the Senior Manager;
• Co-operating fully with Internal Audit to help ensure that Internal Audit can
properly fulfil its role;
• Considering and acting on Internal Audit findings and recommendations or
accepting responsibility for any resultant risk from not doing so. 
4.3 In terms of the GIAS, the status of Internal Audit should enable it to function
effectively, with recognition of the independence of the section fundamental to its
effectiveness. The Chief Audit Executive should have sufficient status to facilitate the
effective discussion of audit strategies, plans, results and improvement plans with
Senior Management. 
4.4 Within North Ayrshire Council, the Senior Manager will have unrestricted access to
the Section 95 Officer, the Monitoring Officer (the Head of Democratic Services), the
Chief Executive and the Chair of the Audit and Scrutiny Committee.

Page 8

PUBLIC INFORMATION
PUBLIC INFORMATION
4.5 In addition, unrestricted access to all Chief Officers and employees of the Council is
afforded to the Senior Manager and all members of Internal Audit staff in the course
of carrying out their work. 
4.6 In terms of accountability and independence, the Senior Manager reports
functionally to the Audit and Scrutiny Committee; this means the Audit and Scrutiny
Committee will:
• Approve the Internal Audit Charter;
• Approve the internal audit plan;
• Receive reports from the Senior Manager on the outcome of Internal Audit work
and any other matters the Senior Manager deems necessary;
• Champion the internal audit function and make enquiries to ensure that it is
adequately resourced to meet its assurance and other key responsibilities;
• Receive periodic confirmation from the Senior Manager that Internal Audit
complies with the requirements of the GIAS. 
4.7 The Senior Manager reports administratively to the Section 95 Officer (the Head of
Service (Finance)). The administrative reporting line will be managed in a manner
that ensures:
• The Senior Manager is accorded open and direct communication with Senior
Management across the Council;
• The Internal Audit function has an adequate and timely flow of information
concerning the activities, plans and initiatives of the Council. 
4.8 It is recognised that the administrative reporting line does not have authority over
the scope of reporting of results of Internal Audit activity. Ultimate authority in this
regard rests with the Senior Manager, who retains the final right of edit over all
Internal Audit reports. 
4.9 The Senior Manager also has managerial responsibility for the Council-wide
functions of risk management, insurance, business continuity planning and health
and safety. In order to ensure that Internal Audit independence and objectivity is
maintained, any audit work in these areas will be carried out by other Internal Audit
staff with the Senior Manager as the client. The Senior Manager will have no
involvement in the delivery or reporting of the audit review and the report will be
published by the Team Manager (Internal Audit). 
5. Rights of Access 
5.1 In relation to audit work being carried out, the Senior Manager and any member of
the Internal Audit section has the authority to:

Page 9

PUBLIC INFORMATION
PUBLIC INFORMATION
• Enter at all reasonable times and without notice any premises or land of the
Council, provided that where such premises or land are leased to a third party
the terms of the lease are observed;
• Have access to, and remove, all records (both paper and electronic), documents
and correspondence within the possession or control of any officer of the
Council, relating to any financial or other matters of the Council;
• Be provided with a separate log-in to any computer system within the Council
and have full access to any system, network, personal computer or other device
in the ownership of the Council;
• Require and receive explanations concerning any matter under examination
from any employee, including Chief Officers, and request such explanations from
any Elected Member;
• Require any employee of the Council to produce cash, stores or any other
Council assets under their control. 
5.2 These rights of access are also embedded within the Council’s Financial
Regulations, which were last approved by the Council on 18 September 2024. 
6. Fraud-related Work 
6.1 As outlined at 4.2 above, responsibility for the prevention and detection of fraud lies
primarily with Senior Management across the Council, not with Internal Audit.
However, Internal Audit staff will be alert in all their work to risks and exposures that
could allow fraud or corruption. The Corporate Fraud Team will also undertake
proactive work to identify potentially fraudulent activity. 
6.2 The Council’s ‘Defalcation Procedures’ require that any suspected fraud against the
Council will be reported to the Senior Manager. 
6.3 The Corporate Fraud Team will investigate suspected instances of fraud against the
Council and report their findings to Senior Management, along with any
recommendations for action to rectify the situation. This may include the
recommendation that Senior Management should consider investigating relevant
members of staff under the Council’s Disciplinary Policy. 
6.4 Senior Management will be responsible for acting on the recommendations of
Internal Audit, including carrying out any disciplinary reviews. 
6.5 Any contact with the Police or the Procurator Fiscal in relation to employee fraud will
be made only by the Chief Executive or by another officer acting with the prior
approval of the Chief Executive.

Page 10

PUBLIC INFORMATION
PUBLIC INFORMATION
7. Consultancy Work
7.1 When invited by Senior Management, Internal Audit may provide advice and
consultancy services on:
• Cost effective controls for new systems and activities;
• Opportunities to reduce costs through greater economy and efficiency within
processes or systems.
7.2 Acceptance of any assignment will be dependent on available resources, the nature
of the assignment and any potential impact on future independent assurances.
7.3 Internal Audit will not accept any consultancy assignment where the Senior Manager
considers that staff do not have the necessary specialist knowledge or skills.
7.4 The role of Internal Audit in a consultancy assignment is to provide advice and
support to Senior Management, who retain the ultimate responsibility for the
decisions taken within the area under review.
7.5 Internal Audit may in future carry out assurance work in service areas where advice
or consultancy services were previously provided. The objectivity of individual audit
staff will be managed in assigning any such assurance work.
8. Audit Reporting
8.1 After the completion of each assignment, Internal Audit will issue a draft report to the
relevant Head of Service, containing the findings of the audit work, an action plan
and an audit opinion on the area under review. Internal Audit will aim to issue this
draft report within 21 days of completion of the audit fieldwork.
8.2 Senior Management is expected to respond to Internal Audit with a completed action
plan within 21 days of the issue of the draft report. A clearance meeting will be
offered to the Head of Service during the 21 day period if they wish to discuss the
findings and facilitate the completion of the action plan.
8.3 Following the return of the completed action plan, Internal Audit will aim to finalise
and publish the report within 14 days.
8.4 Each final Internal Audit report will be issued to the relevant Executive Director and
Heads of Service. Copies will also be made available to the Chief Executive and the
Section 95 Officer.
8.5 Once finalised, each Internal Audit report and action plan will be submitted to the
Audit and Scrutiny Committee.

Page 11

PUBLIC INFORMATION
PUBLIC INFORMATION
8.6 Internal Audit recognises that its responsibility does not cease at the point when a
report is published. Regular follow-up work will be carried out to ensure that actions
are in place and are effective.
8.7 Failure by Senior Management to implement actions within the previously agreed
timescales will be reported to the Audit and Scrutiny Committee at the first meeting
following the end of the quarter in which the action was due to be implemented.
8.8 The Audit and Scrutiny Committee may call for explanations from Senior
Management around actions that have not been implemented and will have
responsibility for agreeing any extensions to timescales.
8.9 The Senior Manager will prepare an annual report to the Audit and Scrutiny
Committee, confirming compliance with PSIAS, highlighting key findings from audit
work during the preceding audit year, and providing an opinion on the internal
control environment of the Council.
8.10 The work of Internal Audit, including the opinion on the control environment, will
contribute to the Council’s review of its corporate governance arrangements, the
outcome of which will be published in the Annual Governance Statement.
9. Audit Resources and Prioritisation of Work
9.1 Work will be prioritised according to risk, through the judgement of the Senior
Manager, and aligned to the Council’s risk registers. The Senior Manager will
consult with the Executive Leadership Team in making this assessment.
9.2 The Senior Manager will determine the actual deployment of available resources
and will do so within the framework of risk prioritisation used to prepare the annual
audit plan approved by the Audit and Scrutiny Committee.
9.3 The audit plan will have within it a provision of resources to address unplanned
work. These resources will be directed towards responding to specific control issues
highlighted by Senior Management during the audit year.
9.4 In the event that the risk assessment within the audit plan identifies a need for more
audit work than there are resources available, the Senior Manager will identify the
shortfall and initially advise the Section 95 Officer followed by the Audit and Scrutiny
Committee as required.
9.5 It will be for the Audit and Scrutiny Committee to decide whether to accept the risks
associated with the non-delivery of sufficient audit work or to recommend to the
Council that it identifies additional resources.

Page 12

PUBLIC INFORMATION
PUBLIC INFORMATION
10. Quality Assurance 
10.1 The Senior Manager will develop and maintain a Quality Assurance and
Improvement Programme that covers all aspects of the Internal Audit activity. This
will include both internal and external assessments. 
10.2 The internal assessments will include:
• Ongoing monitoring of the performance of Internal Audit through the use of
performance indicators, staff supervision and team meetings;
• Periodic self-assessment of the Internal Audit function against the requirements
of the Global Internal Audit Standards (GIAS). 
10.3 External assessments will be conducted at least once every 5 years by a qualified,
independent assessor from outside the organisation. 
10.4 The external assessment may be a full external assessment or a self- assessment
with independent validation. The format will be agreed in advance of each external
assessment by the Section 95 Officer and the Audit and Scrutiny Committee. 
10.5 The findings of each internal and external assessment will be reported to the Audit
and Scrutiny Committee along with a plan for any improvement action that may be
required. 
11. Approval of the Audit Charter 
11.1 This Internal Audit Charter was reported to and approved by the Audit and Scrutiny
Committee of North Ayrshire Council on 13 March 2025. 
11.2 The Charter will be subject to annual review by the Senior Manager. Where any
material changes are required to the Charter, this will be presented to the Audit and
Scrutiny Committee for their approval.