10 - 2023 03 28 Internal Audit Charter 2023
North Ayrshire Council · 28 March 2023
Back to Audit and Scrutiny Committee — 28 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 28 March 2023 Audit and Scrutiny Committee Title: Internal Audit Charter 2023 Purpose: To seek Committee approval of the updated Internal Audit Charter. Recommendation: That the Committee (a) approves the Internal Audit Charter attached at Appendix 1 and (b) agrees that future amendments to the Charter will be made where a need is identified. 1. Executive Summary 1.1 Internal Audit operates in accordance with the requirements of the 'Public Sector Internal Audit Standards (PSIAS)'. The Standards are designed to ensure that common practices are followed across all public sector bodies. 1.2 One requirement of the PSIAS is the preparation of an 'Internal Audit Charter' which must be approved by the Audit and Scrutiny Committee. 1.3 In May 2014 it was agreed that the Charter would be reviewed on a biennial basis or at any other time if required by a material change to the terms of the Charter. 1.4 The existing Internal Audit Charter was approved by the Audit and Scrutiny Committee in September 2020. A revised Charter is attached at Appendix 1 for approval. 2. Background 2.1 The Charter is a formal document that defines the purpose, authority and responsibility of Internal Audit; the section's position within the organisation; authorises access to records, personnel and physical properties relevant to the performance of audit engagements; and defines the scope of Internal Audit activities. 2.2 It was agreed by the former Audit Committee that the Charter should be reviewed on a biennial basis to ensure it remains current and brought to
Page 2
Committee for approval. It is now proposed that an annual review of the Charter will continue to be carried out by the Senior Manager as this is a requirement of the PSIAS, however only where material changes occur would this result in a change to the Charter and require reapproval by Committee. Examples of such circumstances would include: changes to internal structures or arrangements, findings from an internal or external quality assessment, or changes to the standards or guidance around internal audit charters or the requirements of internal audit. 2.3 The Internal Audit Charter has been reviewed and found to remain fit for purpose. 2.4 Minor changes have been required to the Charter to ensure it continues to reflect the organisational structure of the Council and the requirements of the PSIAS: • Updates throughout the document to reflect changes to designations; and • Definition of the mission of Internal Audit, which was a recommendation raised by the external review team as part of the external quality assessment. 3. Proposals 3.1 It is proposed that the Committee (a) approves the Internal Audit Charter attached at Appendix 1 and (b) agrees that future amendments to the Charter will be made where a need is identified. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None.
Page 3
Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 No consultations have been required in the preparation of this report. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
INTERNAL AUDIT CHARTER 2023 Version: Final Date: 28/03/2023 Author: Laura Miller Classification: Public
Page 5
INTERNAL AUDIT CHARTER 2023 1 Introduction 1.1 North Ayrshire Council has adopted the definition of Internal Audit as given in the Public Sector Internal Audit Standards (PSIAS): ‘Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.’ 1.2 PSIAS requires the Council to define its interpretation of the generic terms ‘Chief Audit Executive’, ‘Senior Management’ and ‘Board’. 1.3 For the purposes of this Internal Audit Charter, the role of the ‘Chief Audit Executive’ is fulfilled by the Senior Manager (Audit, Fraud, Safety & Risk), hereafter referred to as the Senior Manager; the Chief Officers are defined as ‘Senior Management’ and the ‘Board’ is deemed to be the Audit and Scrutiny Committee. 2 Responsibilities of Internal Audit 2.1 The mission of internal audit is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. 2.2 The scope of Internal Audit activity includes, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation’s governance, risk management and internal control processes. This enables Internal Audit to provide the Audit and Scrutiny Committee with assurance on the adequacy of these arrangements. 2.3 Internal Audit does this by: • Providing high quality, independent audit services to the Council and its Senior Management; • Performing a systematic and continuous review of the Council’s internal control, risk management and governance arrangements in accordance with a risk-based annual plan approved by the Audit and Scrutiny Committee; • Highlighting opportunities to reduce costs through greater economy, efficiency and effectiveness within existing internal controls throughout the Council’s systems and activities; • Advising on cost effective controls for new systems and activities; • Providing an assurance statement and annual report to the Audit and Scrutiny Committee on the adequacy of the Council’s internal control and governance arrangements.
Page 6
2.4 Internal Audit is responsible for reporting risk exposures and control risks to the Audit and Scrutiny Committee and Senior Management. 2.5 Internal Audit will consult with the Council’s external auditor and with other relevant inspection and review bodies in order to co-ordinate effort and avoid duplication. 3 Standards and Ethics 3.1 Internal Audit will carry out its work in accordance with: • Relevant standards and guidelines issued by the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Institute of Internal Auditors (IIA); • The Council’s ‘Local Code of Corporate Governance’; • The section’s own Internal Audit Manual and Procedures. 3.2 In particular, Internal Audit will adhere to the Public Sector Internal Audit Standards (PSIAS) which were issued by CIPFA and the IIA and were most recently updated in April 2017. The PSIAS incorporates the mandatory elements of the IIA’s International Professional Practices Framework – the definition of Internal Auditing (see 1.1 above), the Code of Ethics and the International Standards for the Professional Practice of Internal Auditing. 3.3 Internal Auditors will comply with appropriate professional ethics at all times. These cover: • Integrity; • Objectivity; • Confidentiality; • Competency. 3.4 The Chief Audit Executive will hold a relevant professional qualification and will be suitably experienced. Audit staff will adhere to the requirements of the Council’s Employee Code of Conduct, the Seven Principles of Public Life and the ethical standards of any professional institute of which they may be a member. Staff will undertake Continuing Professional Development (CPD) as required and will also keep their skills and knowledge current through appropriate professional learning and the Council’s employee development programme. 4 Position of Internal Audit within the Council 4.1 Internal Audit is an independent activity. It is not an extension of, or a substitute for, the functions of line management and must remain free from any undue influence or other pressure affecting its actions and reporting. 4.2 At all times, the responsibilities of Senior Management across the Council include:
Page 7
• Maintaining proper internal controls in all processes for which they have responsibility to ensure probity in systems and operations; • Preventing and detecting fraud and irregularities within their service areas and reporting any suspicions to the Senior Manager; • Co-operating fully with Internal Audit to help ensure that Internal Audit can properly fulfil its role; • Considering and acting on Internal Audit findings and recommendations or accepting responsibility for any resultant risk from not doing so. 4.3 In terms of the PSIAS, the status of Internal Audit should enable it to function effectively, with recognition of the independence of the section fundamental to its effectiveness. The Chief Audit Executive should have sufficient status to facilitate the effective discussion of audit strategies, plans, results and improvement plans with Senior Management. 4.4 Within North Ayrshire Council, the Senior Manager will have unrestricted access to the Section 95 Officer, the Monitoring Officer (the Head of Democratic Services), the Chief Executive and the Chair of the Audit and Scrutiny Committee. 4.5 In addition, unrestricted access to all Chief Officers and employees of the Council is afforded to the Senior Manager and all members of Internal Audit staff in the course of carrying out their work. 4.6 In terms of accountability and independence, the Senior Manager reports functionally to the Audit and Scrutiny Committee; this means the Audit and Scrutiny Committee will: • Approve the Internal Audit Charter; • Approve the internal audit plan; • Receive reports from the Senior Manager on the outcome of Internal Audit work and any other matters the Senior Manager deems necessary; • Make enquiries to ensure that Internal Audit is adequately resourced to meet its assurance and other key responsibilities; • Receive periodic confirmation from the Senior Manager that Internal Audit complies with the requirements of PSIAS. 4.7 The Senior Manager reports administratively to the Section 95 Officer (the Head of Service (Finance)). The administrative reporting line will be managed in a manner that ensures: • The Senior Manager is accorded open and direct communication with Senior Management across the Council; • The Internal Audit function has an adequate and timely flow of information concerning the activities, plans and initiatives of the Council.
Page 8
4.8 It is recognised that the administrative reporting line does not have authority over the scope of reporting of results of Internal Audit activity. Ultimate authority in this regard rests with the Senior Manager, who retains the final right of edit over all Internal Audit reports. 4.9 The Senior Manager also has managerial responsibility for the Council-wide functions of risk management, insurance, business continuity planning and health and safety. In order to ensure that Internal Audit independence and objectivity is maintained, any audit work in these areas will be carried out by other Internal Audit staff with the Senior Manager as the client. The Senior Manager will have no involvement in the delivery or reporting of the audit review and the report will be published by the Team Manager (Internal Audit). 5 Rights of Access 5.1 In relation to audit work being carried out, the Senior Manager and any member of the Internal Audit section has the authority to: • Enter at all reasonable times and without notice any premises or land of the Council, provided that where such premises or land are leased to a third party the terms of the lease are observed; • Have access to, and remove, all records (both paper and electronic), documents and correspondence within the possession or control of any officer of the Council, relating to any financial or other matters of the Council; • Be provided with a separate log-in to any computer system within the Council and have full access to any system, network, personal computer or other device in the ownership of the Council; • Require and receive explanations concerning any matter under examination from any employee, including Chief Officers, and request such explanations from any Elected Member; • Require any employee of the Council to produce cash, stores or any other Council assets under their control. 5.2 These rights of access are also embedded within the Council’s Financial Regulations, which were last approved by the Council on 16th December 2020. 6 Fraud-related Work 6.1 As outlined at 4.2 above, responsibility for the prevention and detection of fraud lies primarily with Senior Management across the Council, not with Internal Audit. However, Internal Audit staff will be alert in all their work to risks and exposures that could allow fraud or corruption. The Corporate Fraud Team will also undertake proactive work to identify potentially fraudulent activity. 6.2 The Council’s ‘Defalcation Procedures’ require that any suspected fraud against the Council will be reported to the Senior Manager.
Page 9
6.3 The Corporate Fraud Team will investigate suspected instances of fraud against the Council and report their findings to Senior Management, along with any recommendations for action to rectify the situation. This may include the recommendation that Senior Management should consider investigating relevant members of staff under the Council’s Disciplinary Policy. 6.4 Senior Management will be responsible for acting on the recommendations of Internal Audit, including carrying out any disciplinary reviews. 6.5 Any contact with the Police or the Procurator Fiscal in relation to employee fraud will be made only by the Chief Executive or by another officer acting with the prior approval of the Chief Executive. 7 Consultancy Work 7.1 When invited by Senior Management, Internal Audit may provide advice and consultancy services on: • Cost effective controls for new systems and activities; • Opportunities to reduce costs through greater economy and efficiency within processes or systems. 7.2 Acceptance of any assignment will be dependent on available resources, the nature of the assignment and any potential impact on future independent assurances. 7.3 Internal Audit will not accept any consultancy assignment where the Senior Manager considers that staff do not have the necessary specialist knowledge or skills. 7.4 The role of Internal Audit in a consultancy assignment is to provide advice and support to Senior Management, who retain the ultimate responsibility for the decisions taken within the area under review. 7.5 Internal Audit may in future carry out assurance work in service areas where advice or consultancy services were previously provided. The objectivity of individual audit staff will be managed in assigning any such assurance work. 8 Audit Reporting 8.1 After the completion of each assignment, Internal Audit will issue a draft report to the relevant Head of Service, containing the findings of the audit work, an action plan and an audit opinion on the area under review. Internal Audit will aim to issue this draft report within 21 days of completion of the audit fieldwork. 8.2 Senior Management is expected to respond to Internal Audit with a completed action plan within 21 days of the issue of the draft report. A clearance meeting will be offered to the Head of Service during the 21 day
Page 10
period if they wish to discuss the findings and facilitate the completion of the action plan. 8.3 Following the return of the completed action plan, Internal Audit will aim to finalise and publish the report within 14 days. 8.4 Each final Internal Audit report will be issued to the relevant Executive Director and Heads of Service. Copies will also be made available to the Chief Executive and the Section 95 Officer. 8.5 Once finalised, each Internal Audit report and action plan will be submitted to the Audit and Scrutiny Committee. 8.6 Internal Audit recognises that its responsibility does not cease at the point when a report is published. Regular follow-up work will be carried out to ensure that actions are in place and are effective. 8.7 Failure by Senior Management to implement actions within the previously agreed timescales will be reported to the Audit and Scrutiny Committee at the first meeting following the end of the quarter in which the action was due to be implemented. 8.8 The Audit and Scrutiny Committee may call for explanations from Senior Management around actions that have not been implemented and will have responsibility for agreeing any extensions to timescales. 8.9 The Senior Manager will prepare an annual report to the Audit and Scrutiny Committee, confirming compliance with PSIAS, highlighting key findings from audit work during the preceding audit year, and providing an opinion on the internal control environment of the Council. 8.10 The work of Internal Audit, including the opinion on the control environment, will contribute to the Council’s review of its corporate governance arrangements, the outcome of which will be published in the Annual Governance Statement. 9 Audit Resources and Prioritisation of Work 9.1 Work will be prioritised according to risk, through the judgement of the Senior Manager, and aligned to the Council’s risk registers. The Senior Manager will consult with the Executive Leadership Team in making this assessment. 9.2 The Senior Manager will determine the actual deployment of available resources and will do so within the framework of risk prioritisation used to prepare the annual audit plan approved by the Audit and Scrutiny Committee. 9.3 The audit plan will have within it a provision of resources to address unplanned work. These resources will be directed towards responding to
Page 11
specific control issues highlighted by Senior Management during the audit year. 9.4 In the event that the risk assessment within the audit plan identifies a need for more audit work than there are resources available, the Senior Manager will identify the shortfall and initially advise the Section 95 Officer followed by the Audit and Scrutiny Committee as required. 9.5 It will be for the Audit and Scrutiny Committee to decide whether to accept the risks associated with the non-delivery of sufficient audit work or to recommend to the Council that it identifies additional resources. 10 Quality Assurance 10.1 The Senior Manager will develop and maintain a Quality Assurance and Improvement Programme that covers all aspects of the Internal Audit activity. This will include both internal and external assessments. 10.2 The internal assessments will include: • Ongoing monitoring of the performance of Internal Audit through the use of performance indicators, staff supervision and team meetings; • Periodic self-assessment of the Internal Audit function against the requirements of the Public Sector Internal Audit Standards (PSIAS). 10.3 External assessments will be conducted at least once every 5 years by a qualified, independent assessor from outside the organisation. 10.4 The external assessment may be a full external assessment or a self- assessment with independent validation. The format will be agreed in advance of each external assessment by the Section 95 Officer and the Audit and Scrutiny Committee. 10.5 The findings of each internal and external assessment will be reported to the Audit and Scrutiny Committee along with a plan for any improvement action that may be required. 11 Approval of the Audit Charter 11.1 This Internal Audit Charter was reported to and approved by the Audit and Scrutiny Committee of North Ayrshire Council on 28th March 2023. 11.2 The Charter will be subject to annual review by the Senior Manager. Where any material changes are required to the Charter, this will be presented to the Audit and Scrutiny Committee for their approval.