7 - 2023 03 28 IA Plan 2023-24
North Ayrshire Council · 28 March 2023
Back to Audit and Scrutiny Committee — 28 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 28 March 2023 Audit and Scrutiny Committee Title: Internal Audit Plan 2023/24 Purpose: To inform the Committee of the proposed Internal Audit plan for 2023/24. Recommendation: That the Committee approves the Internal Audit plan for 2023/24. 1. Executive Summary 1.1 This report presents the proposed Internal Audit Plan for 2023/24. A review has been carried out, including consultation with members of the Executive Leadership Team, to identify areas which will be subject to audit review. 1.2 The audit plan is risk-based and fully utilises the available resource of 647 audit days. 2. Background 2.1 The work of Internal Audit is governed by the requirements of the Public Sector Internal Audit Standards (PSIAS) 2017. The standards, issued jointly by the Chartered Institute of Public Finance & Accountancy (CIPFA) and the Chartered Institute of Internal Auditors (IIA), require the Senior Manager (Audit, Fraud, Safety & Risk) to establish a risk-based internal audit plan to determine the priorities of the internal audit activity, consistent with the Council’s goals and objectives. 2.2 In the development of the internal audit plan, the PSIAS requires the Senior Manager to consult with senior management and obtain a thorough understanding of the Council’s strategies, key business objectives, associated risks, and risk management processes. The audit plan also needs to be flexible, with the ability to adjust in response to changes in the business, risks, operations, programmes, systems and controls. 2.3 The objective of the work of internal audit is to enable the Senior Manager to form an evidence based independent opinion at the end of the year on the adequacy of the Council’s internal control, risk and governance arrangements. This opinion forms part of the Annual Governance Statement for the year which is included within the Council’s financial statements.
Page 2
2.4 The Internal Audit Charter is a formal document which defines the internal audit activity’s purpose, authority and position. The Senior Manager reviews the Internal Audit Charter on an annual basis and presents any changes to the Audit and Scrutiny Committee for approval. The Internal Audit Charter has been reviewed and an updated version is presented to this meeting of the Committee for reapproval. 2.5 The Senior Manager is also required to ensure that internal audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. The Internal Audit Team currently comprises a Senior Manager, an Internal Audit Manager, two Internal Auditors and a Computer Auditor. All members of the team hold professional accountancy or audit qualifications and are suitably experienced. 2.6 The resources available to deliver the internal audit plan take into account an estimate of the number of available working days per team member. The total estimate for the year is detailed as follows: Activity Planned Days Audit reviews 462 Time allocated to the North Ayrshire Integration Joint Board 15 Consultancy and contingency (including non-fraud investigations) 55 Other planned audit days (e.g. follow up, audit planning, reporting to Committee and internal audit development) 115 Total 647 2.7 Appendix 1 contains the detailed audit plan for 2023/24 with an allocation of audit days assigned to each assignment. It should be noted that these audit days are indicative only. The plan may therefore be subject to change throughout the year, depending on a number of factors such as available resources, time required to complete reviews, and unplanned work arising throughout the year. 2.8 The internal audit plan for 2023/24 is risk based, as required by the standards. A number of sources of evidence are used to identify all potential auditable areas and to assess the risk or significance of each one to ensure the plan adds the most value to the Council. The process includes: • maintaining an up-to-date audit universe of all potential auditable areas; • consultation with members of the Executive Leadership Team (ELT); • review of the Council’s operational, corporate and strategic risk registers; • review of the Council Plan 2019-24; • review of national publications from Audit Scotland, CIPFA and IIA; and • knowledge of the business through previous audit assignments and internal audit’s own risk assessment of those areas. 2.9 Examples of the key risk factors which have influenced the 2023/24 internal audit plan are as follows: • The financial environment in which the Council is operating has been identified as a strategic risk for the Council, and therefore a review of the financial viability and resilience of the Council is included in the audit plan for 2023/24. • In order to facilitate payment for low value transactions, Council services use corporate procurement cards. The potential misuse of these cards is identified by internal audit as a high risk and therefore further work will be carried out in
Page 3
2023/24 to assess the adequacy and effectiveness of arrangements that are in place to ensure compliance with relevant policies and procedures. • Transformation and change management is identified as a strategic risk for the Council. Internal audit will focus on the governance arrangements in place to take forward a programme of transformational change. • European Structural and Investment Funds (ESIF) ended in December 2022 and are being replaced by the UK Shared Prosperity Fund (SPF). With the final drawdown of all funds to be completed by 31 December 2023, the internal audit review will focus on the accuracy and completeness of claims to ensure all funds due to the Council are drawn down in advance of this deadline. • iPayImpact is a secure online payment platform for parents and carers to pay for school meals, trips and events online. The system was introduced in 2021/22 and a review will be carried out to ensure key policies and procedures exist for the management of the system, and that adequate controls are in place for any manual interventions. • The cost of living crisis, including the rising costs in relation to construction, has led to the addition of two reviews within the proposed audit plan – capital monitoring, and rental income and arrears. • Climate change is highlighted not only as a strategic risk for the Council, but also recognised as a global risk. Internal audit will be involved in a consultancy capacity in the Council’s 4th iteration of the Environmental Sustainability & Climate Change Strategy. • Cyber resilience is identified as a strategic risk for the Council. Added to this, most global risk literature continues to identify cyber security as the number one global risk. The Scottish Government’s cyber resilience framework is intended to support public sector organisations to develop and improve their cyber security arrangements. Internal audit will base the next phase of cyber resilience audits on aspects of this framework. • Regular coverage of the Ayrshire Growth Deal (AGD) is required by the governance arrangements for the programme. Audit work in 2023/24 will focus on the AGD revenue projects. 2.10 Progress against the internal audit plan will be reported quarterly to the Audit & Scrutiny Committee. 2.11 Training needs within the service are reviewed on an annual basis during the Council’s Our Time to Talk process, as well as ad-hoc opportunities identified during the year as events arise. The Senior Manager is an active member of the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) and the IIA’s Local Authority Forum. The Computer Auditor is an active member of the Computer Audit Sub-Group of SLACIAG (CASG). All members of the internal audit team will be attending the SLACIAG two-day conference in June 2023. 3. Proposals 3.1 It is proposed that the Committee approves the Internal Audit plan for 2023/24.
Page 4
4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 Consultation has taken place on an individual basis with the Executive Leadership Team during the preparation of the Internal Audit plan. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 5
APPENDIX 1 Key Corporate Systems Audit Objective Total Indicative Days Accounts payable Review controls in place within a sample of services around their use of Procurement Cards 15 Financial resilience and viability Review the arrangements and assumptions around medium and long term financial plans and strategies, tested against the CIPFA Financial Management Code 15 HR/Payroll systems Review the controls within the Education network for leavers and movers 15 TOTAL AUDIT DAYS 45 Other Systems Audit Objective Total Indicative Days Capital Monitoring Examine the effectiveness of the Council's capital monitoring arrangements 15 HR/Payroll policies and procedures Review the Council's workforce planning arrangements 15 Supply teachers Review new system and associated procedure notes for the management and booking of supply teachers 15 Pupil Equity Funding/ Closing the Attainment Gap Review a sample of schools and ensure PEF spending is in accordance with plans, and there is a clear link between spend and closing the attainment gap 15 Transformation and Change Management Review the Council's approach to transformation and its progress with best value 20 Self-Directed Support Review the use of 'Self Directed Support' to provide assurance that appropriate controls are in place and operating effectively 15 Carers Act Review progress with the delivery of the requirements of the Carers (Scotland) Act 2016 15 Community based support - Adults Review controls in relation to Community based support, with a particular focus on Adults 15 Integration Joint Board audit days Carry out audit work as agreed by the Performance and Audit Committee of the North Ayrshire Integration Joint Board 15 Employability Review of European monies to ensure controls are in place for the full drawdown of ESF prior to the final closure of the programmes 15 iPayImpact Review the controls around the collection of income through the new iPayImpact online payment system for schools 15 Housing - rental income and arrears Examine a range of controls within Housing with a focus on the processes for the management of rent arrears 15 Property Asset Management Review the Council's property asset management arrangements focussing on the Property Lifecycle Investment fund 15 Waste Consultancy assignment - participation in an advisory capacity in the comprehensive review of Waste Management 10 Sustainability & Climate Change Consultancy assignment - provide real-time advice and feedback on the 4th Environmental Sustainability & Climate Change Strategy 15 TOTAL AUDIT DAYS 225 ICT Auditing Audit Objective Total Indicative Days ICT - information security management Utilising the Scottish Government's cyber resilience framework, review controls around information security management 20 ICT - access control Utilising the Scottish Government's cyber resilience framework, review controls around access 20 ICT - environmental and physical security Utilising the Scottish Government's cyber resilience framework, review controls around physical and environmental security 20 ICT - business continuity Utilising the Scottish Government's cyber resilience framework, review controls around business continuity in the event of a cyber incident 20 TOTAL AUDIT DAYS 80 Governance Audit Objective Total Indicative Days Code of Corporate Governance Review aspects of the Council's arrangements for completion of the Delivering Good Governance Framework 10 Ayrshire Growth Deal Review the arrangements in North Ayrshire Council in relation to the Ayrshire Growth Deal revenue projects 20 Community Planning Community keyholding arrangements 10 TOTAL AUDIT DAYS 40 INTERNAL AUDIT PLAN - April 2023 to March 2024 NORTH AYRSHIRE COUNCIL [PUBLIC]
Page 6
Regularity Audits Audit Objective Total Indicative Days Accounts Payable Transaction Testing Use data analysis software to interrogate the HR/Payroll system and examine any anomalies which arise. 15 Payroll Transaction Testing Use data analysis software to interrogate the Accounts Payable system and examine any anomalies which arise. 15 Early Years Centres Review financial and other controls within the Council's stand alone Early Years Centres 10 TOTAL AUDIT DAYS 40 Following the Public Pound Audit Objective Total Indicative Days Community Funding Examine the controls around funding support provided by the Council to a range of community groups 15 Regeneration Delivery Plan and Funding Review of Place-based investment programmes and funding streams 20 Community Councils Annual audit of Community Councils accounts' to ensure Council funding is used in accordance with the Council's Scheme of Administration. 10 Tenants and Residents Associations Annual audit of the accounts of various Tenants and Residents Associations 2 TOTAL AUDIT DAYS 47 Other Planned Audit Work Audit Objective Total Indicative Days Prior year audit work Finalising audits from the 2022-23 audit plan that were not fully complete by the end of March 2023 44 Audit consultancy: ad-hoc advice Providing advice to council services in response to ad-hoc queries 10 Audit consultancy: project work Participating in project work to support developments in other council services 25 Follow-up Follow up of previous audit reports to ensure that appropriate action has been taken 15 Audit planning and monitoring Preparing audit plans and monitoring progress and performance against plans 20 Audit and Scrutiny Committee Supporting the Council's Audit and Scrutiny Committee by preparing reports, attending meetings and delivering training for elected members as required 25 Governance documents Review of governance documents (e.g. Codes of Financial Practice) 2 Development of the Audit service Carry out developmental work to further enhance the efficiency of the audit section 5 Internal Audit self-assessment against PSIAS Undertake a quality assurance programme for Internal Audit in line with the requirements of the Public Sector Internal Audit Standards (PSIAS) 2 Annual Accounts Work in relation to the Council's annual accounts for preparing the Annual Governance Statement 2 TOTAL AUDIT DAYS 150 Contingencies & Investigations Audit Objective Total Indicative Days Non-Fraud Investigations Time allocated for unplanned non-fraud investigations arising during the year 20 TOTAL AUDIT DAYS 20 TOTAL AUDIT PLAN 2023-24 647 [PUBLIC]