3 - 2022 09 13 External Quality Assessment
North Ayrshire Council · 27 September 2022
Back to Audit and Scrutiny Committee — 27 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: External Quality Assessment of Internal Audit by West Dunbartonshire Council Purpose: To inform the Committee of the findings of the recent external review of Internal Audit carried out by West Dunbartonshire Council. Recommendation: It is proposed that the Committee: (a) notes the findings and action plan from the review of Internal Audit; (b) notes the positive nature of the assessment; and (c) records its thanks to West Dunbartonshire Council Internal Audit for carrying out the review. 1. Executive Summary 1.1 Internal Audit operates in accordance with the requirements of the 'Public Sector Internal Audit Standards (PSIAS)'. The standards are designed to ensure that common standards and practices are followed across all public sector bodies. 1.2 One requirement of the PSIAS is that the Internal Audit service should undergo an external quality assessment, at least every 5 years. The first assessment was undertaken by Falkirk Council in 2017. 1.3 The second assessment has recently been undertaken by West Dunbartonshire Council Internal Audit and this report presents the key findings and action plan. 2. Background 2.1 The PSIAS was introduced in April 2013 and requires all Internal Audit teams to undergo an external quality assessment at least every 5 years; this can be either a full external assessment or a self-assessment with independent validation. 2.2 The Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) has developed an external review network, where each participating Council Internal Audit team will carry out a review of another authority, and will in turn be reviewed by another, different Council.
Page 2
2.3 The benefits of joining this network are the opportunity to share good operational practice from elsewhere, both through being reviewed by another Council and by carrying out a review elsewhere, and the absence of any financial cost. 2.4 A review of the Council's Internal Audit team has recently been completed by the Shared Service Manager (Audit & Fraud) from West Dunbartonshire Council and her report is attached in full at Appendix 1. 2.5 The review assessed the compliance of the Council's Internal Audit team with the 14 sections of the PSIAS and notes that the team fully conforms with 13 of the standards and generally conforms with one. Overall the assessor has been able to provide assurance that the Council's Internal Audit team complies with the requirements of the PSIAS. 2.6 The assessment is a very positive one. There are four low priority ‘routine’ actions for implementation which will further improve compliance. The action plan is included within Appendix 1. One action has already been completed. 2.7 The Shared Service Manager (Audit & Fraud) will attend the Audit and Scrutiny Committee to report on her findings. 3. Proposals 3.1 It is proposed that the Audit and Scrutiny Committee: (a) notes the findings and action plan from the review of Internal Audit, (b) notes the positive nature of the assessment, and (c) records its thanks to West Dunbartonshire Council Internal Audit for carrying out the review. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None.
Page 3
Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 No consultation was required as part of this review. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 4
June 2022 Page 1 EXTERNAL QUALITY ASSESSMENT 2 OF NORTH AYRSHIRE COUNCIL’S INTERNAL AUDIT JULY 2022 Final Report Recipients: Laura Miller, Senior Manager Audit, Fraud, Safety and Insurance (Chief Audit Executive)
Page 5
EXECUTIVE SUMMARY 2 1. INTRODUCTION 1.1 The mandatory Public Sector Internal Audit Standards (PSIAS), published initially in April 2013 and updated most recently in March 2017, apply to all internal audit service providers in the UK public sector, whether in-house, provided via a shared service arrangement or outsourced. To supplement the PSIAS, and provide specific guidance surrounding its application within a local government setting, the Chartered Institute of Public Finance and Accountancy (CIPFA) compiled a Local Government Application Note, which was last updated in 2019. 1.2 The objectives of the PSIAS are to define the nature of internal auditing within the UK public sector; set out basic principles for carrying out internal audit; establish a framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations; establish the basis for the evaluation of internal audit performance and drive improvement planning. 1.3 The PSIAS require the Chief Audit Executive (the Senior Manager, Audit, Fraud, Safety and Insurance in North Ayrshire Council) to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation, and enable evaluation of the internal audit activity’s (Internal Audit service in North Ayrshire Council) conformance with the PSIAS, including the Mission of Internal Audit, Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. 1.4 To assist its members to meet the five-yearly external assessment requirement, the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) established a collaborative system of formal peer reviews. This approach not only assists with ensuring that independent assessors, and their teams, have appropriate knowledge and experience of the local government internal audit environment but also removes the financial burden from councils, associated with procuring these services externally. The allocation of assessors / assessment teams to councils participating in the peer review process was undertaken autonomously, ensuring that, amongst other governing principles, local authorities with perceived / known conflicts of interest could not review one another. At the outset, assessors were required to formally declare any interests so that these could be appropriately addressed during the allocation process. West Dunbartonshire Council was selected to carry out the external assessment for North Ayrshire Council. 1.5 To support the peer review process, SLACIAG developed a comprehensive External Quality Assessment (EQA) framework, including an EQA Checklist for Assessing Conformance with the PSIAS and the Local Government Application Note (EQA Checklist) and a key Stakeholder Questionnaire proforma. The external assessment of North Ayrshire Council’s Internal Audit service has been carried out by West Dunbartonshire Council’s Shared Service Manager – Audit & Fraud utilising this framework. 1.6 This report provides a high level summary of requirements for each standard per the PSIAS and CIPFA Local Government Application Note and sets out the findings, conclusions and recommendations from the external assessment, which involved discussions with key members of staff, including the Chief Audit Executive, review of the most recent self-assessment carried out utilising the EQA Checklist and consideration of other relevant supporting documentation / information (Evidence Pack) including working paper files and completed stakeholder questionnaires. A comprehensive list of supporting documentation / information and completed stakeholder questionnaires considered as part of the assessment can be found at appendices B and C respectively.
Page 6
June 2022 Page 1 2. OVERALL CONCLUSION 2.1 The overall conclusion of the external assessment is that North Ayrshire Council’s Internal Audit service fully conforms with 13 areas of the Public Sector Internal Audit Standards and generally conforms in relation to one area. There were no areas assessed as partial or non-conformance. A summary of totals is set out in the undernoted table and a full summary of assessment, by assessment area can be found at Appendix A: Fully Conforms Generally Conforms Partially Conforms Does Not Conform TOTALS 13 1 0 0 2.2 The main areas for improvement highlighted in the report are as follows: • The Internal Audit Charter could be enhanced to provide specific reference to the Mission of Internal Audit. • The Chief Audit Executive has recognised the need to improve the documentation of the audit risk assessment process and the overall assurance process. Consideration should also be given to inclusion of the risk factors which have influenced the audit plan in relation to the risk-based audit assurance work in the covering report. • The Chief Audit Executive has recognised the need for referencing audit work to the strategic and service risk registers within the audit programme. • The Chief Audit Executive has recognised the need to include a specific section on exclusions within the audit programme. Consideration should also be given to including exclusions where identified within the draft and final reports to management. 2.3 Full details of the assessment recommendations and management responses can be found in the Action Plan at Appendix D. 3. SECTION A – MISSION OF INTERNAL AUDIT AND CORE PRINCIPLES The PSIAS state that the Mission of Internal Audit articulates what internal audit aspires to accomplish within an organisation, which is ‘to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight’. Taken as a whole, the Core Principles for the Professional Practice of Internal Auditing, as set out in the PSIAS, articulate internal audit effectiveness. For an internal audit function to be considered effective, all Core Principles should be present and operating effectively. Failure to achieve any of the Core Principles would imply that an internal audit activity was not as effective as it could be in achieving the Mission of Internal Audit. 3.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used, along with specific consideration surrounding the achievement of the Core Principles, to conclude that the Internal Audit service at North Ayrshire Council fully conforms with accomplishing the Mission of Internal Audit as detailed above. 4. SECTION B – DEFINITION OF INTERNAL AUDITING The PSIAS state that internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.
Page 7
4 4.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used to conclude that the Internal Audit service at North Ayrshire Council fully conforms with the definition of Internal Auditing as detailed above. 5. SECTION C – CODE OF ETHICS The PSIAS state that the purpose of the Institute of Internal Auditor’s Code of Ethics is to promote an ethical culture in the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, control and governance. Internal auditors in UK public sector organisations must conform to the Code of Ethics as set out in the PSIAS. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. 5.1 Evidence obtained from assessing conformance with other standards in the PSIAS, in particular the Attribute Standards 1000 – Purpose Authority and Responsibility, 1100 – Independence and Objectivity, 1200 – Proficiency and Due Professional Care and Professional Standards 2000 – Managing the Internal Audit Activity and 2300 – Performing the Engagement, has been used to conclude that North Ayrshire Council’s Internal Audit service fully conforms with the requirement to comply with the Code of Ethics. 6. SECTION D – ATTRIBUTE STANDARDS Attribute Standards apply to organisations and individual internal auditors providing the internal audit services in a local authority. 6.1 1000 - Purpose, Authority, and Responsibility The PSIAS state that the purpose, authority and responsibility of the internal audit activity must be formally defined in an Internal Audit Charter, consistent with the Mission of Internal Audit and the mandatory elements of the International Professional Practices Framework. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval. The internal audit charter must also: • define the terms ‘board’ and ‘senior management’ for the purposes of internal audit activity; • cover the arrangements for appropriate resourcing; • define the role of internal audit in any fraud-related work; and • describe safeguards to limit impairments of independence or objectivity if internal audit or the chief audit executive undertakes non-audit activities. 6.1.1 North Ayrshire Council’s Internal Audit Charter is periodically reviewed with the most recent review taking place in September 2020. The Internal Audit Charter was approved by the Audit & Scrutiny Committee on 29 September 2020. 6.1.2 The internal self-assessment by the Chief Audit Executive at North Ayrshire Council recognised that the current Internal Audit Charter does not specifically reference the Mission of Internal Audit “To enhance and protect organisational value by providing risk- based and objective assurance, advice and insight”. However, this external assessment considers that this is covered by the detail included at section 2 Responsibilities of Internal Audit of the Internal Audit Charter. 6.1.3 The Chief Audit Executive has already considered, as an enhancement, the inclusion of specific reference to the Mission of Internal Audit when the Internal Audit Charter is next reviewed.
Page 8
5 6.1.4 Having considered the findings above, it has been concluded that the Internal Audit service at North Ayrshire Council fully conforms with Standard 1000 on Purpose, Authority and Responsibility. 6.2 1100 - Independence and Objectivity The internal audit activity must be independent and internal auditors must be objective in performing their work. Various aspects of independence and objectivity are covered in this standard as well as 1200, including reporting functional lines of the CAE, the relationship between the CAE and the board and any impairment to individual internal auditors’ objectivity or independence. Reporting and management arrangements must be put in place that preserve the CAE’s independence and objectivity, in particular with regard to the principle that the CAE must be independent of the audited activities. 6.2.1 The Chief Audit Executive reports functionally to the Audit & Scrutiny Committee and administratively to the Head of Finance, who is a member of the Council’s Executive Leadership Team. The Chief Audit Executive has direct and unrestricted access to the Chief Executive and the Chair of the Audit & Scrutiny Committee and this has been confirmed through the Terms of Reference for the Audit & Scrutiny Committee. These reporting/access arrangements are clearly defined in the Internal Audit Charter as are safeguards to limit impairment of independence or objectivity. 6.2.2 In support of organisational independence, the Chief Audit Executive attends Audit & Scrutiny Committee meetings to present all internal audit reports (including, for example, the Internal Audit Charter, Annual Report, Internal Audit Plan and reports / executive summaries from the planned audits) to Elected Members. The reports are all submitted in the Head of Service’s name with the Chief Audit Executive’s information listed as a contact for further information. Through observation of Audit & Scrutiny Committee meetings held via webcast during 2021/22 it was noted that the Chief Audit Executive attends each Audit & Scrutiny Committee and presented all internal audit reports at the meeting. 6.2.3 The Chief Audit Executive has operational responsibility for some activities subject to audit and this is communicated to stakeholders via the Internal Audit Charter which sets out the procedure whereby the Chief Audit Executive is the client and the Team Manager is responsible for the oversight and reporting of the audit work to mitigate any impairments. 6.2.4 All staff within the Internal Audit service are required to complete a register of interests form on an annual basis. 6.2.5 North Ayrshire Council’s Internal Audit service fully conforms with Standard 1100 on Independence and Objectivity. 6.3 1200 - Proficiency and Due Professional Care The CAE must be professionally qualified, suitably experienced and responsible, in accordance with the organisation’s human resources processes, for recruiting appropriate staff. He or she is responsible for ensuring that up-to-date job descriptions exist, reflecting roles and responsibilities, and that person specifications define the required qualifications, competencies, skills, experience and personal attributes. The CAE should periodically assess individual auditors’ skills and competencies against those set out in the relevant job descriptions and person specifications. Any training or development needs identified should be included in an appropriate ongoing development programme that is recorded and regularly reviewed and monitored. In addition, all internal auditors have a personal responsibility to undertake a programme of continuing professional development (CPD) to maintain and develop their competence. This may be fulfilled through requirements set by professional bodies or
Page 9
6 through the organisation’s own appraisal and development programme. Auditors should maintain a record of such professional training and development activities. The internal audit activity should be appropriately resourced to meet its objectives. It should have appropriate numbers of staff in terms of grades, qualifications, personal attributes and experience or have access to appropriate resources in order to meet its objectives and to comply with these standards. The PSIAS states that the CAE must obtain competent advice and assistance if the activity is unable to perform all or part of an engagement. 6.3.1 The Chief Audit Executive holds a relevant professional qualification (ACCA) and is suitably experienced, with 14 years internal audit experience within a Scottish local government environment. The Chief Audit Executive is a member of SLACIAG (or otherwise) and regularly attends and contributes to meetings. In relation to the two SLACIAG Sub-groups, the Computer Audit Sub-Group (CASG) and the Scottish Local Authorities Investigators Group (SLAIG), North Ayrshire Council’s Internal Audit service is represented on both. 6.3.2 To support the Chief Audit Executive in North Ayrshire Council’s Internal Audit service, a Team Manager is in place for Internal Audit, a Team Supervisor for Fraud, a Team Manager for Safety, and a Team Manager for Risk & Insurance. There are a total of 18 members of staff in the Internal Audit service, including the Chief Audit Executive, Team Managers/Supervisors. The Internal Audit service delivers internal audit services to North Ayrshire Council and North Ayrshire Integration Joint Board. The team has dedicated IT audit and fraud resources. 6.3.3 The Internal Audit service has an appraisal process “Our Time to Talk” which is a corporate process. This is carried out on an annual basis and in in place for Internal audit staff. 6.3.4 The Internal Audit service is represented on a number of corporate groups, including the Municipalisation Working Group, Chris21 HR/Payroll System Project Board, and the O365 Information and Collaboration Project Board. 6.3.5 The Chief Audit Executive and all members of the Internal Audit service have specific CPD requirements to adhere to. Staff training records are maintained on the corporate HR system. 6.3.6 Throughout 2021-22, Audit & Scrutiny meetings were subject to live webcasting. These webcasts are also available as archive webcasts which were reviewed as part of the external quality assessment where it was observed that the Chief Audit Executive demonstrated sufficient knowledge and experience and that all members of the Internal Audit service had exercised due professional care. 6.3.7 North Ayrshire Council’s Internal Audit service fully conforms with standard 1200 on Proficiency and Due Professional Care. 6.4 1300 - Quality Assurance and Improvement Programme The PSIAS state that the Chief Audit Executive must develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outside the organisation, and enable evaluation of the internal audit activity’s conformance with the PSIAS, including the Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement.
Page 10
7 The public sector requirement in the PSIAS states that results of the QAIP and progress against any improvement plans must be reported in the annual report. 6.4.1 Internal audit reports are reviewed by the Chief Audit Executive prior to issue and working papers are, in general, reviewed by the Chief Audit Executive or Audit Manager. Where the assignment is carried out by the Audit Manager, the Chief Audit Executive will review the working paper file. 6.4.2 Client feedback is actively pursued by the Internal Audit service for assignments carried out within North Ayrshire Council. 6.4.3 A range of performance measures are in place for the Internal Audit service which aligns to balanced scorecard reporting of performance by the Institute of Internal Auditors. These are formally reported to the Audit & Scrutiny Committee on an annual basis as part of the Internal Audit Annual Report. 6.4.4 A formal self-assessment of conformance with the PSIAS was carried out in September 2021, using the EQA Checklist. This was used by West Dunbartonshire Council as the baseline for the external quality assessment in 2022. 6.4.5 North Ayrshire Council’s Internal Audit service fully conforms with Standard 1300 on Quality Assurance and Improvement Programme. 7. SECTION E – PERFORMANCE STANDARDS Performance Standards describe the nature of the internal audit services being provided and provide criteria against which the performance of an internal audit function can be measured. 7.1 2000 - Managing the Internal Audit Activity The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organisation. The internal audit activity is effectively managed when it achieves the purpose and responsibility included in the internal audit charter, it conforms with the PSIAS, its individual members conform with the Code of Ethics and the PSIAS and it considers trends and emerging issues that could impact the organisation. The internal audit activity adds value to the organisation and its stakeholders when it considers strategies, objectives and risks; strives to offer ways to enhance governance, risk management, and control processes; and objectively provides relevant assurance. 7.1.1 An annual Internal Audit Plan is compiled by the Chief Audit Executive outlining the planned programme of work to be undertaken. The planning process includes consultation with members of the Executive Leadership Team on planned audit areas, a review of strategic and service risk registers, discussions with external audit to minimise duplication and maximise audit coverage for the Council and review of other local authority internal audit plans through wider discussion groups. 7.1.2 The annual Internal Audit Plan is presented to the Audit and Scrutiny Committee for approval. 7.1.3 Progress towards completion of the Internal Audit Plan, and the individual audits contained within it is reported to Audit & Scrutiny Committee as an update to each meeting of the Committee. 7.1.4 The Internal Audit Plan for 2021-22 was presented to the January 2021 meeting of the Audit & Scrutiny Committee and good engagement was observed by the Committee Members in discharging their scrutiny role of the proposed audit coverage.
Page 11
8 7.1.5 Through review of the Internal Audit Plan for 2021-22 an area for improvement was identified in relation to including the risk factors which have influenced the scope of the areas subject to risk-based audit assurance work within the covering report. The Chief Audit Executive also recognised that the documentation of audit risk assessment and overall assurance mapping process could be improved. 7.1.6 It is recommended that consideration is given to include the risk factors which have influenced the scope of the risk-based plan within the covering report relating to the Annual Audit Plan. It is also recognised that the Chief Audit Executive plans to improve the documented audit risk assessment and assurance mapping process. 7.1.7 North Ayrshire Council’s Internal Audit service generally conforms with Standard 2000 on Managing the Internal Audit Activity. 7.2 2100 - Nature of Work The internal audit activity must evaluate and contribute to the improvement of the organisation’s governance, risk management, and control processes using a systematic, disciplined, and risk-based approach. Internal audit credibility and value are enhanced when auditors are proactive and their evaluations offer new insights and consider future impact. More specifically, the internal audit activity must assess and make appropriate recommendations to improve the organisation’s governance processes, evaluate the effectiveness and contribute to the improvement of risk management processes and assist the organisation in maintaining effective controls by evaluating their efficiency and effectiveness and promoting continuous improvement. 7.2.1 It was recognised that the Chief Audit Executive plans to enhance the audit planning process by specifically referencing audit work to strategic and service risk registers. 7.2.2 North Ayrshire Council’s Internal Audit fully conforms with Standard 2100 on Nature of Work. 7.3 2200 - Engagement Planning Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing and resource allocations. The plan must consider the organisation’s strategies, objectives and risks relevant to the engagement. The CIPFA Local Government Application note states that for each engagement, a brief should be prepared, discussed and agreed with relevant managers. The brief should establish the objectives, scope and timing for the assignment and its resource and reporting requirements. Audit work should be undertaken using a risk-based audit approach. 7.3.1 A standard methodology is in place for Internal Audit engagement planning which includes an audit programme which sets out the background to the area being audited, the risks, the timing of the audit, the audit resource, the report distribution, the audit test objectives and conclusions reached. 7.3.2 North Ayrshire Council’s Internal Audit service fully conforms with Standard 2200 on Engagement Planning. 7.4 2300 - Performing the Engagement Internal auditors must identify, analyse, evaluate and document sufficient information to achieve the engagement’s objectives. At each stage of the audit, auditors should consider what specific work needs to be conducted and evidence needs to be gathered to achieve the engagement objectives and support an independent and objective audit opinion. Systems should be in place to
Page 12
9 ensure that auditors obtain and record, within the working papers, sufficient evidence to support their conclusions, professional judgements and recommendations. Working papers should always be sufficiently complete and detailed to enable an experienced internal auditor with no previous connection with the audit to ascertain what work was performed, re-perform it if necessary and support the conclusions reached. The CAE should also specify how long all audit documentation should be retained, whether held on paper or electronically. All audit work should be subject to an appropriate internal quality review process. Internal auditors must be alert to the possibility of intentional wrongdoing, errors and omissions, poor value for money, failure to comply with management policy and conflicts of interest when performing their individual audits. They must also have sufficient knowledge to identify indicators that fraud or corruption may have been committed. 7.4.1 Internal Audit Manual sets out the procedure in relation to undertaking a planned audit, including preparing working papers and setting up working paper files. In addition, the manual also includes standard procedures in place for dealing with other types of work e.g. advice and consultancy and investigating fraud and irregularity. 7.4.2 Standard working papers are used at each stage of the audit. Templates are referenced within the Internal Audit Manual. 7.4.3 During the course of each audit, regular discussions take place between the team carrying out the assignment and the Chief Audit Executive or Team Manager. This ensures that any significant issues are escalated appropriately and that the audit is on track to be delivered on time and within budget. 7.4.4 All working papers are subject to review by either the Chief Audit Executive or the Audit Manager. This quality control process ensures that the risks and objectives of the assignment have been met and that conclusions are suitably evidenced. 7.4.5 A records retention and disposal schedule is in place for Internal Audit files which sets out the legal basis for retention and the timescales. 7.4.6 North Ayrshire Council’s Internal Audit service fully conforms with Standard 2300 on Performing the Engagement. 7.5 2400 - Communicating Results The basic aims of every internal audit report should be to: • give an opinion on the risk and controls of the area under review, building up to the annual opinion on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control; • prompt management to implement the agreed actions for change leading to improvement in the control environment and performance; and • provide a formal record of points arising from the audit and, where appropriate, of agreements reached with management, together with appropriate timescales. Each report should include the scope and purpose of the audit to help the reader to understand the extent, or limitations, of the assurance(s) provided by the report. During the course of the audit, key issues should be brought to the attention of the relevant manager to enable them to take corrective action and to avoid surprises at the closure stage. Before issuing the final report, the internal auditor should normally discuss the contents with the appropriate levels of management to confirm the factual accuracy, to seek comments and to confirm the agreed management actions. A draft report is useful for this purpose. Recommendations should be prioritised according to risk. The recommendations and the resultant management action plans should be agreed prior to the issue of the final report. Any areas of disagreement between the internal auditor and management that cannot be resolved by discussion should be recorded in the action
Page 13
10 plan and the residual risk highlighted. Those weaknesses giving rise to significant risks that are not agreed should be brought to the attention of a more senior level of management and the board. As set out in the PSIAS, the CAE must deliver an annual internal audit opinion and report that can be used by the organisation to inform its annual governance statement. This must include the annual internal audit opinion concluding on the overall adequacy and effectiveness of the organisation’s governance, risk and control framework, a summary of the audit work from which the opinion is derived (including reliance placed on work by other assurance bodies); and a statement of conformance with the PSIAS and the results of the internal audit QAIP. 7.5.1 A standard report template is used for all audit assignments. The report includes background to the area being audited, the objectives and scope of the audit, the findings and agreed actions together with responsible owners and implementation dates. The audit report also sets out the overall opinion on the level of assurance that is being provided. 7.5.2 Draft reports are discussed with the client service to agree factual accuracy as well as allow the client to respond to recommendations with implementation dates and details of responsible officers. 7.5.3 The overall level of assurance for the audit area is included in the overall Internal Audit Annual Report which allows the Chief Audit Executive to provide an overall opinion on the adequacy and effectiveness of the Council’s governance, risk management and control processes for that year. 7.5.4 The Chief Audit Executive through the self-assessment exercise identified that exclusions to the scope of the audit assignment could be more explicit within the audit programme. We would also recommend that any exclusions are also included in the draft and final reports to management. 7.5.5 Through observation of Audit & Scrutiny Committee meetings held via webcasting it was demonstrated that senior management value the work of Internal Audit and are committed to improving the control environment through the implementation of internal audit actions. 7.5.6 North Ayrshire Council’s Internal Audit fully conforms with Standard 2400 on Communicating Results. 7.6 2500 - Monitoring Progress The PSIAS place responsibility for monitoring progress with the CAE to ensure that management actions have been effectively implemented or, if not, that senior management have accepted the risk of not taking action. The CAE must, therefore, implement a follow-up process for ensuring the effective implementation of audit results or ensuring senior management are aware of the consequences of not implementing an action point and are prepared to accept the risk of such consequences occurring. The results of this process should be communicated to the board. The CAE should develop escalation procedures for cases where agreed actions have not been effectively implemented by the date agreed. These procedures should ensure that the risks of not taking action have been understood and accepted at a sufficiently senior management level. The effective involvement of the board in the follow-up process is critical to ensuring that it works. The CAE should consider revising the internal audit opinion in light of findings from the follow-up process. The findings of follow-up reviews should inform the planning of future audit work. 7.6.1 The Internal Audit Manual sets out the process for audit follow up. The completed action plan for each audit is monitored for completion through the Council’s performance
Page 14
11 management system Pentana. As part of the quarterly reporting to the Audit & Scrutiny Committee, information is provided on actions which have not been completed within the agreed timescales. Evidence obtained by Internal Audit in relation to audit follow up is retained on the shared drive in accordance with relevant retention and disposal timescales. 7.6.2 Through observation of Audit & Scrutiny Committee meetings held via webcasting, it was demonstrated that there is effective challenge and scrutiny by Elected Members in relation to progress in implementing Internal Audit action plans. 7.6.3 North Ayrshire Council’s Internal Audit service fully conforms with Standard 2500 on Monitoring Progress. 7.7 2600 - Communicating the Acceptance of Risks When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organisation, they must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, they must communicate the matter to the board. It is not the responsibility of the chief audit executive to resolve the risk. 7.7.1 Management comments are added to each finding and where no action is proposed this is included within the action plan. 7.7.2 Where the Chief Audit Executive determines any risk to be significant, this would be raised with the Chief Executive, S95 Officer and the Chair of the Audit & Scrutiny Committee. 7.7.3 The Internal Audit Annual Report for 2021-22 fully sets out the scope of internal audit responsibilities to provide an opinion on the Council’s governance, risk management and control procedures. The report did not highlight any concerns regarding management’s acceptance of risk which required to be brought to the attention of the Committee. 7.7.4 North Ayrshire Council’s Internal Audit service fully conforms to the Standard on Communicating the Acceptance of Risk. Andi Priestman Shared Service Manager – Audit & Fraud West Dunbartonshire Council July 2022
Page 15
12 APPENDIX A – SUMMARY OF ASSESSMENT REF PAGE No. ASSESSMENT AREA Fully Conforms Generally Conforms Partially Conforms Does Not Conform Section A Mission of Internal Audit and Core Principles Section B Definition of Internal Auditing Section C Code of Ethics Section D ATTRIBUTE STANDARDS 1000 Purpose, Authority and Responsibility 1100 Independence and Objectivity 1200 Proficiency and Due Professional Care 1300 Quality Assurance and Improvement Programme Section E PERFORMANCE STANDARDS 2000 Managing the internal Audit Activity 2100 Nature of Work 2200 Engagement Planning 2300 Performing the Engagement 2400 Communicating Results 2500 Monitoring Progress 2600 Communicating the Acceptance of Risks TOTALS 13 1
Page 16
13 APPENDIX B – EVIDENCE PACK • North Ayrshire Council PSIAS Self-Assessment 2021-22 • Internal Audit Charter 2020-22 • Financial Regulations December 2020 • Minutes of Audit & Scrutiny Committee September 2020 • Minutes of Audit & Scrutiny Committee • Scheme of Administration June 2021 • Internal Audit Structure Chart • Internal Audit Job Descriptions • Internal Audit Professional Qualifications • Internal Audit Training Records • Internal Audit Annual Reports 2020-21 and 2021-22 • NAC Recruitment Policy • NAC Disciplinary Policy • NAC Performance Appraisal Process • NAC Code of Conduct for Employees • Staff Register of Interests • NAC Information Security Policy • NAC Data Protection Policy • NAC Whistleblowing Policy • NAC Defalcation Procedures • NAC Counter Fraud and Corruption Strategy • Internal Audit Manual 2021/22 • Internal Audit Annual Audit Plan 2021/22 • Mid-Year review of Internal Audit Annual Audit Plan 2021/22 • Budget Monitoring Report example • 6-monthly survey process • EQA 1 • Annual Governance Statement 2020-21 • IJB PAC Minutes June 2021 • Audit Universe • Audit File Checklist • Audit Programme Template • Draft Report Template • File Review Template • Retention Schedule • Audit Actions Follow Up Report
Page 17
14 APPENDIX C – STAKEHOLDER QUESTIONNAIRES Due to the ongoing Coronavirus restrictions, stakeholder engagement was considered through reviewing archived webcasting of Audit & Scrutiny Committees meetings held during 2021 to 2022 where it was observed that there is good engagement and challenge and also recognition of the support and value that is added to the organisation by the Internal Audit service by both Elected Members and senior management.
Page 18
15 APPENDIX D – ACTION PLAN No. Para Recommendation Management Response Responsible Officer / Agreed Completion Date 1 6.1.3 The Internal Audit Charter should be enhanced to provide specific reference to the “Mission of Internal Audit” at its next review. This will be incorporated into the next iteration of the Internal Audit Charter, which is due for review at the next audit planning round for 2023/24. Laura Miller, CAE 31 March 2023 2 7.1.5 The Chief Audit Executive has recognised the need to improve the documentation of the audit risk assessment process and the overall assurance process. Consideration should also be given to the inclusion of the risk factors which have influenced the audit plan in relation to the risk-based audit assurance work in the covering report. Work commenced to improve the documentation of the risk assessment at the 2022/23 audit planning process. In addition, the overall assurance process was also more fully documented at the time the annual internal audit report and opinion for 2021/22 was produced. Further action will also be taken during the 2023/24 internal audit planning process to document the risk factors which have influenced the audit plan and ensuring these are referenced within the covering report. Laura Miller, CAE 31 March 2023 3 7.2.1 The Chief Audit Executive has recognised the need for referencing audit work to the strategic and service risk registers within the audit planning process. The audit universe was amended for the 2022/23 audit planning process to include reference to the strategic and service risk registers. Laura Miller, CAE Complete 4 7.5.4 The Chief Audit Executive has recognised the need to include a specific section on exclusions within the audit programme. It is recommended that where exclusions are identified that these are also included in the draft and final reports issued to management. Standard templates relating to the audit engagement (the audit programme and the audit report) will be amended to capture the need to document exclusions from the scope of the audit. This will also be reflected in the Audit Manual. Laura Miller, CAE 30 September 2022 Critical Significant Routine