9. (05) 2025 03 13 Internal Audit Plan 2025-26 (Combined) v.2
North Ayrshire Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 13 March 2025 Audit and Scrutiny Committee Title: Internal Audit Plan 2025/26 Purpose: To inform the Committee of the proposed internal audit plan for 2025/26. Recommendation: That the Committee approves the internal audit plan for 2025/26. 1. Executive Summary 1.1 Internal Audit provides an independent and objective opinion on the Council’s risk management, governance and control environment by evaluating its effectiveness. This report presents the proposed internal audit plan for 2025/26. 1.2 Prior to the start of each financial year, internal audit in conjunction with senior management, put together a proposed plan of audit work. The objective of our planning process and subsequent plan is to put us in a position to provide a well- informed and comprehensive annual audit opinion, based on sufficient and appropriate coverage of key business objectives, associated risks, and risk management processes. 2. Background Internal Audit Plan 2025/26 2.1 The outcomes of each of the audits in our planned programme of work will provide senior management and Members with assurance that the current risks faced by the Council in these areas are adequately controlled and managed. 2.2 A number of factors are considered when putting together the risk based internal audit plan for 2025/26, including: • Consultation with senior management; • Review of the Council’s key objectives and Council Plan 2023-2028; • Review of the Council’s fundamental business processes and key services; • Review of the Council's current risk management framework, processes and risk management maturity; • Review of the key risks featuring in the Council's risk registers; • Internal Audit’s own risk assessment based on knowledge of the business and incorporating findings from previous internal audit work; and
Page 2
• Internal Audit’s awareness of emerging regional and national risk factors. 2.3 The approach to the delivery of the internal audit plan will be for it to remain flexible throughout the year to respond to new and emerging risks. This was trialled in 2024/25 with the adoption of a ‘rolling’ internal audit plan, which was reviewed and updated on a continual basis, thereby remaining agile to change. The 2025/26 plan has been designed to continue with this agile approach and confirmed work will cover a maximum of a six-month period with a rolling forward plan of possible areas for future consideration. Changes to the internal audit plan will be presented to the Committee for information through regular progress reports. This approach is fully in line with the new global internal audit standards which require the audit plan to be risk- based and dynamic, reflecting timely adjustments in response to changes affecting the organisation. 2.4 The documented risk assessment is based on a risk universe which is maintained by internal audit and is used to document the consultation which takes place between internal audit and senior management. Management are welcome to feed into the risk universe to help ensure it is updated on a continuous basis. The risk universe documents risk factors such as: • Links to the strategic priorities within the Council Plan for 2023-2028; • Links to strategic, corporate and operational risk registers; • Whether the auditable area is a source of significant risk; • Whether there is significant value to the Council in the audit being carried out; • known risk factors arising from local and national issues; and • risk factors arising from previous internal audit work and knowledge of the Council. 2.5 An overall conclusion is reached from an assessment of each risk area, which categorises audits into the following priorities: • Priority A – a ‘must do’ audit based on risk (very high risk); • Priority B – a ‘should do’ audit, time permitting (high risk); • Priority C – a ‘may do’ audit, time permitting (moderate risk); and • Priority D – an audit where the result would not be of sufficient value to the Council (low risk). 2.6 Examples of the key risk factors which have influenced the early part of the 2025/26 internal audit plan are as follows: • A significant fraud was identified relating to council tax refunds at another Scottish Council and has been highlighted by the Accounts Commission as an area in which local authorities should consider as part of their planned assurance work. Refunds relating to non-domestic rates can also be high value, which heightens the level of risk. • The impact of cost inflation is highlighted as a corporate risk for the Council and is likely to have a significant effect on the delivery of the current capital programme. Internal audit will undertake a review of the capital monitoring arrangements to assess the level of control in this area. • Cyber resilience is identified as a strategic risk for the Council. Added to this, most global risk literature continues to identify cyber security as the number one global risk. The Scottish Government’s cyber resilience framework is intended to support
Page 3
public sector organisations to develop and improve their cyber security arrangements. Internal audit will continue to base the next phase of cyber resilience audits on aspects of this framework. • Staffing levels and workforce shortfalls are noted as operational risks within the HSCP risk register. These factors, if not adequately controlled, can increase reliance on unplanned overtime across the directorate. • The requirement for ongoing building repairs and maintenance has been noted across various operation risk registers and therefore an audit of the processes for prioritising and allocating repairs will be undertaken to obtain assurance in this area. • Whilst school funds are separate to council funds, reputationally the risk of mismanagement lies with the council. A number of schools have not yet implemented cashless systems and there is therefore an increased opportunity for fraud or error. • An internal review of grant compliance processes is currently taking place and Internal Audit will provide advisory services to Connected Communities to support the development of new procedures, guidelines etc. 2.7 The aim is to produce an agile, dynamic, risk-based internal audit plan containing key areas of coverage. The overall objective of the work of internal audit is to enable the Senior Manager to form an evidence based independent opinion at the end of the year on the adequacy of the Council’s internal control, risk and governance arrangements. This opinion forms part of the Annual Governance Statement for the year which is included within the Council’s financial statements. 2.8 The benefit of a rolling internal audit plan is to be able to continually update this as new areas of work are agreed. New audits are risk assessed and added to the rolling plan which may mean lower risk audits are delivered at a later date. If a new audit area arises which is of such significant risk, this could lead to previously agreed work being deferred. As noted above, any such changes will be presented back to the Committee for information through regular reports. 2.9 Internal audit coverage can never be absolute, and responsibility for risk management, governance and internal control arrangements will always remain fully with management. As such, internal audit cannot provide complete assurance over any area, and equally cannot provide any guarantee against material errors, loss or fraud. 2.10 Appendix A contains the internal audit plan for quarters one and two of 2025/26. The plan will be added to throughout the year, with a list of potential audit areas provided at Appendix B. Audit titles and high level scopes are indicative at this stage for planning our resources. At the start of each audit, detailed planning will be carried out to agree the objectives and the scope of the work. The plan will therefore be subject to change throughout the year, depending on a number of factors such as available resources, time required to complete reviews, and unplanned work arising throughout the year. 2.11 The Senior Manager is required to ensure that internal audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. The Internal Audit Team currently comprises a Senior Manager, an Internal Audit Manager, two Internal Auditors and a Computer Auditor. All members of the team hold professional accountancy or audit qualifications and are suitably experienced.
Page 4
2.12 In addition to the programme of audit work to be carried out, time is also required to be set aside throughout 2025/26 to support the following areas: • Consultancy – both ad hoc advice and project work • Follow up of prior year internal audit action points • Audit planning and monitoring • Committee attendance and reporting • Development of the internal audit service • Self-assessments and external quality assessments against internal audit standards • Review of governance documents such as Codes of Financial Practice and the Annual Governance Statement. 2.13 A further fundamental development taking place during 2025/26 is the implementation of the new Global Internal Audit Standards (GIAS). These were launched globally with implementation expected from January 2025, however an April 2025 implementation date has been confirmed for the UK public sector. North Ayrshire Council will continue to work with peers across the sector to ensure that compliance with the new standards is delivered during 2025/26. This will potentially mean changes to processes, procedures and working practices which will need to take priority during the year to ensure ongoing compliance with the standards. Internal Audit Performance 2.14 As part of the progress reporting regime, we will report on internal audit performance. The following targets will be used to measure the performance of the internal audit activity: Performance Measure Performance Target Delivery of internal audit plan – percentage completed at year end >85% Quality of audit work – overall client satisfaction >90% Outcomes from audit work – value to the organisation >90% Conformance with the Global Internal Audit Standards (GIAS) 2.15 From 1 April 2025 the work of Internal Audit will be governed by the requirements of the Global Internal Audit Standards (GIAS), which replaces the Public Sector Internal Audit Standards (PSIAS) 2017. The standards, issued by the Chartered Institute of Internal Auditors (IIA) and amended for use within the UK public sector, require the Senior Manager (Audit, Fraud, Safety, Risk & Insurance) to establish a risk-based internal audit plan to determine the priorities of the internal audit activity, consistent with the Council’s goals and objectives. 2.16 Every five years, Internal Audit is subject to an External Quality Assessment (EQA) covering the activity of the service. The last of these was carried out under the PSIAS, in July 2022 and reported to the Committee in September 2022. The assessment confirmed conformance with the PSIAS. An updated self-assessment will be carried out during 2025 to confirm compliance with the new standard. 2.17 The Internal Audit Charter is a formal document which defines the internal audit activity’s purpose, authority and position. The Senior Manager reviews the Internal
Page 5
Audit Charter on an annual basis and presents any changes to the Audit and Scrutiny Committee for approval. The Internal Audit Charter has been reviewed and updated to account for the changes in the audit standards. 3. Proposals 3.1 It is proposed that the Committee approves the Internal Audit plan for 2025/26. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 Consultation has taken place on an individual basis with the Executive Leadership Team during the preparation of the Internal Audit plan. Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk and Insurance), on 01294 324607. Background Papers None.
Page 6
Internal Audit Plan 2025/26 Quarters 1 & 2 Appendix A Audit Area to Deliver in Plan Directorate/Service Planned Quarter Priority Link to Council Plan Link to Risk Registers Social Care Establishments HSCP Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Strategic Risk HSCP - Overtime Controls HSCP Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk CT / NDR Refunds Finance / People & ICT Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Capital Monitoring Finance Q2 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk Accounts Payable Transactions People & ICT Q2 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A ELC Payments to Partner Nurseries Education Q2 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A School Funds Education Q1 B N/A N/A Absence Management People & ICT Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk ICT - Asset Management People & ICT Q1 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Buildings and Estate Maintenance Place Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk
Page 7
Audit Area to Deliver in Plan Directorate/Service Planned Quarter Priority Link to Council Plan Link to Risk Registers Tenants & Residents Associations Communities & Housing Ongoing D Communities and Local Democracy – we will have active, inclusive and resilient communities N/A Consultancy - Grant Compliance Communities & Housing Ongoing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk
Page 8
Rolling Internal Audit Plan Appendix B These reviews will form part of the rolling plan for 2025/26. The plan will continue to be adjusted as the year progresses to reflect current organisational risks and issues. Ongoing risk assessments will be undertaken to determine the priority areas to include in the plan. Potential Future Audit Areas Directorate/Service Priority Link to Council Plan Link to Risk Registers Corporate - Performance All B All N/A Corporate - Business Continuity Planning All C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk Grant Compliance Communities & Housing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Stores Controls Communities & Housing C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Community Associations Communities & Housing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk ARC Compliance Testing Communities & Housing / Place B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Advisory - Equalities Democratic B N/A Strategic Risk Freedom of Information Democratic A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk School Inventory Management Education B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Residential Placements Education B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Child Poverty Policy Education C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Education - Handling of Medication Education C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A General Ledger Finance D N/A N/A Community Based Support - Young People HSCP B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk
Page 9
Potential Future Audit Areas Directorate/Service Priority Link to Council Plan Link to Risk Registers HSCP - Business Continuity Planning HSCP B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk Financial Assessments - non-residential HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Care Home Sustainability HSCP B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Review of HSCP Charging Policy HSCP C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Financial Sustainability IJB A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Payroll Transaction Testing People & ICT A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Agency Staff & Workers (IR35) People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Payroll – Non-standard payments / allowances People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A ICT - Incident Detection People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Fuel Controls Place B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Neighbourhood Services - Overtime Controls Place B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Flood Programme Place C Climate Change – achieving net-zero by 2030 Strategic Risk and Operational Risk Advisory - Decriminalised Parking Arrangements Place C N/A N/A Ayrshire Growth Deal Place A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Shared Prosperity Fund Place C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk