APPENDIX 2
Ref / Conformance with the Standard / Y / P / N / Evidence1 / Definition of Internal Auditing
Using evidence gained from assessing conformance with otherStandards, is the internal audit activity:
a)Independent?
b) Objective? /
/ The internal audit Charter.
Declarations of interest signed by Auditors.
Audit Code of Conduct.
Audit Committee approves the Charter and risk based audit plan, and Members consider the Service’s budget and resource plan at the same time as the Audit Plan is approved. / 1
Using evidence gained from assessing conformance with otherStandards, does the internal audit activity use a systematic and disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes within the organisation? / / Audit risk assessments reflect linkages with corporate objectives. The assessments ensure areas with higher impact/risk are reviewed more frequently.
Audit is represented at the Risk Action Group and on the Corporate Governance Group where higher level risks and risk management generally are considered.
Risk assessment is continually updated after audit completion. / 2
2 / Code of Ethics
Integrity
Using evidence gained from assessing conformance with otherStandards, do internal auditors:
a) Perform their work with honesty, diligence and responsibility?
b) Observe the law and make disclosures expected by the law and theprofession?
c) Not knowingly partake in any illegal activity nor engage in acts thatare discreditable to the profession of internal auditing or to theorganisation?
d) Respect and contribute to the legitimate and ethical objectives of theorganisation? /
/ Auditors sign the Audit Code of Conduct and are bound by the Council’s Employee Code.
Every effort is made to ensure Auditors do not audit an area of work for which they were previously responsible.
Auditors are rotated wherever possible. Auditor findings and subsequent reports are challenged at review stage by team leaders and Audit Management. / 3
Objectivity
Using evidence gained from assessing conformance with otherStandards, do internal auditors display objectivity by not:
a) Taking part in any activity or relationship that may impair or bepresumed to impair their unbiased assessment?
b) Accepting anything that may impair or be presumed to impair theirprofessional judgement?
c) Disclosing all material facts known to them that, if not disclosed, maydistort the reporting of activities under review? /
/ Internal audit charter.
Declarations of interest signed by Auditors.
Audit Code of Conduct
Monitoring and review of review outcomes and recommendations at Team Leader/Audit Management level.
Avoiding potential conflicts of interest when assigning audits to Auditors. Rotation of audits wherever possible. / 4
Confidentiality
Using evidence gained from assessing conformance with otherStandards, do internal auditors display objectivity by:
a) Acting prudently when using information acquired in the course oftheir duties and protecting that information?
b) Not using information for any personal gain or in any manner thatwould be contrary to the law or detrimental to the legitimate and ethicalobjectives of the organisation? /
/ Audit Code of Conduct. Council’s Employee Code. Monitoring and review of audit work. Feedback from clients. Regular reporting to Audit Committee of reviews and review outcomes. / 5
Competency
Using evidence gained from assessing conformance with otherStandards, do internal auditors display objectivity by:
a)Only carrying out services for which they have the necessaryknowledge, skills and experience?
b) Performing services in accordance with the PSIAS?
c) Continually improving the proficiency and effectiveness and quality of their services, for example through CPD schemes? /
/ Professional (CIPFA) qualifications. Competency framework (Audit and Corporate) Appraisals. Internal/external training and continuing professional development (20 hours CPD linked to appraisal process).
QAIP programme developed, which includes a balanced scorecard for monitoring conformance with the Standard, Team meetings to assess performance. Customer Satisfaction Surveys. / 6
Do internal auditors have regard to the Standards of Public Life’s Seven
Principles of Public Life? / / Internal Audit Charter.
Audit Code of Conduct.
Council’s Employee Code.
Signing declarations of interest. / 7
Standards
3 / Attribute Standards
3.1 / 1000 Purpose, Authority and Responsibility
Does the internal audit charter include a formal definition of:
a) the purpose
b) the authority, and
c) the responsibility
of the internal audit activity consistent with the Public Sector Internal Audit Standards (PSIAS)? / / Included in Audit Charter reported to Audit Committee 24 Feb 2014 / 8
LGAN / Does the internal audit charter define the terms ‘board’ and ‘seniormanagement’, for the purposes of the internal audit activity?
Note that it is expected that the audit committee will fulfil the role of theboard in the majority of instances. / / Charter defines both these terms specifically. / 9
Does the internal audit charter also: / 10
a) Set out the internal audit activity’s position within the organisation? /
LGAN / b) Establish the CAE’s functional reporting relationship with the board? /
LGAN / c) Establish the accountability, reporting line and relationship between the CAE and those to whom the CAE may report administratively? /
LGAN / d) Establish the responsibility of the board and also the role of thestatutory officers (such as the CFO, the monitoring officer and the head of paid service) with regards to internal audit? /
LGAN / e) Establish internal audit’s right of access to all records, assets, personnel and premises and its authority to obtain such information andexplanations as it considers necessary to fulfil its responsibilities? /
LGAN / f) Define the scope of internal audit activities? /
LGAN / g) Recognise that internal audit’s remit extends to the entire controlenvironment of the organisation? /
h) Identify internal audit’s contribution to the review of effectiveness ofthe control environment, as set out in the Accounts and Audit (England) Regulations 2011? /
i) Establish the organisational independence of internal audit? / / Charter also refers to reporting independence
j) Cover the arrangements for appropriate resourcing? /
k) Define the role of internal audit in any fraud-related work? / / Also included in Counter Fraud Strategy
l) Set out the existing arrangements within the organisation’s anti-fraudand anti-corruption policies, to be notified of all suspected or detected fraud, corruption or impropriety? / / Also included in Counter Fraud Strategy
m) Include arrangements for avoiding conflicts of interest if internal auditundertakes non-audit activities? /
n) Define the nature of assurance services provided to the organisation, as well as assurances provided to parties external to the organisation? /
o) Define the nature of consulting services? /
p) Recognise the mandatory nature of the PSIAS? / / Included in Covering Report
Does the chief audit executive (CAE) periodically review the internalaudit charter and present it to senior management and the board for approval? / / Reviewed and updated annually and prepared alongside audit plan.
Audit Committee 25 February 2013
Audit Committee 24 February 2014 / 11
Does the CAE attend audit committee meetings? / / 12
Does the CAE contribute to audit committee agendas? / / CAE presents quarterly monitoring reports on Internal Audit activity, as well as the Annual Report. CAE also
includes items that may be of interest/ affect future role of Audit Committee e.g. Future of Local Audit / 13
3.2 / 1100 Independence and Objectivity
Does the CAE have direct and unrestricted access to senior management and the board? / / Yes as outlined in the Charter / 14
Does the CAE have free and unfettered access to, as well as communicate effectively with, the chief executive or equivalent and the chair of the audit committee? / / Yes as outlined in the Charter / 15
Are threats to objectivity identified and managed at the following levels:
a) Individual auditor? / / Auditors sign declaration of interest.
Auditors sign the Audit Code of Conduct which covers the need to make a balanced assessment. To be able to do that auditors should not:-
a)participate in any activity or relationship that would impair that unbiased attitude.
b)Accept anything that would impair their professional judgement.
c)Disclose all material facts that would distort any report. / 16
b) Engagement? / / Attempts to influence the outcome of individual engagements would be reported to Team Leaders/CAE for investigation.
At engagement level every effort is made to ensure that auditors do not audit an area of work for which they were previously responsible.
Also, where possible, audits are rotated.
Auditor findings and subsequent report are challenged at review stage by team leaders/CAE.
c) Functional? / / Although CAE has operational responsibility for Treasury Management and VAT, CAE takes no part in those audits. Head of Service agrees scope/recommendations.
d) Organisation? / / Access to information/officers and reporting arrangements allow CAE access to all levels of senior management/members of Audit Committee/Leader of the Council and any external agency.
Although the audit plan is circulated amongst senior managers for comments there is no undue attempt to influence the frequency/timing of audits.
1110 Organisational Independence
Does the CAE report to an organisational level equal or higher to the corporate management team? / / Line manager is Head of Finance but reports to Corporate Governance Group chaired and attended by member of CMT. Individual audit reports sent to corporate directors for information/action. / 17
LGAN / Does the CAE report to a level within the organisation that allows theinternal audit activity to fulfil its responsibilities? / / Individual engagement reports sent to corporate directors. CAE reports to, and is a member of, Corporate Governance Group. CAE reports to, and attends Audit Committee. / 18
LGAN / Have reporting and management arrangements been put in place thatpreserve the CAE’s independence and objectivity?
This is of particular importance when the CAE is line managed byanother officer of the authority. / / Set out in charter. / 19
LGAN / Does the CAE’s position in the management structure:
a) Reflect the influence he or she has on the control environment?
b) Provide the CAE with sufficient status to ensure that audit plans, reports and action plans are discussed effectively with the board?
c) Ensure that he or she is sufficiently senior and independent to be ableto provide credibly constructive challenge to senior management? / / CAE reports on the entire control environment. Engagement reports are sent to appropriate Corporate Director and Head of Service as well as individual manager. Follow up work is undertaken to ensure agreed recommendations are implemented. If not an escalation procure is in place.
Results of audits are reported to Corporate Governance Group and Audit Committee. No interference with development of audit plan.
There is no evidence to suggest that the CAE does not provide constructive challenge to senior management, however CAE would most likely require support from one of the corporate directors most likely the Section 151 Officer or Monitoring Officer. / 20
Does the CAE confirm to the board, at least annually, that the internal audit activity is organisationally independent?
The following examples can be used by the CAE when assessing theorganisational independence of the internal audit activity:
The board:
a) approves the internal audit charter / / a)24 Feb 2014 / 21
b) approves the risk-based audit plan / / b)24 Feb 2014
c) approves the internal audit budget and resource plan / / c)Members approve the Council’s overall budget and attend budget briefings where they can challenge budget decisions. Internal Audit’s budget and resource plan is reported to Audit Committee at the same time as the Audit Plan is approved and have the opportunity to question the adequacy of the resources.
d)receives communications from the CAE on the activity’s performance / / d)Yes quarterly updates, annual report
e)approves decisions relating to the appointment and removal of the CAE / / e)Appointment and replacement decisions are reported to Audit Committee for
f) seeks reassurance from management and the CAE as to whetherthere are any inappropriate scope or resource limitations. / / f)24 Feb 2014 for CAE assurance
Does the chief executive or equivalent undertake, Countersign, contribute feedback to or review the performance appraisal of the CAE? / / Appraisal undertaken by Head of Service, and reviewed by Corporate Director of Resources. / 22
Is feedback sought from the chair of the audit committee for the CAE’s performance appraisal? / / However any performance issues would be addressed. / 23
1111 Direct Interaction with the Board
Does the CAE communicate and interact directly with the board? / / Attends Audit Committee meetings / 24
1120 Individual Objectivity
Do internal auditors have an impartial, unbiased attitude? / / Auditors sign declaration of interest.
Auditors sign the Audit Code of Conduct which covers the need to make a balanced assessment. To be able to do that auditors should not:-
a)participate in any activity or relationship that would impair that unbiased attitude.
b)Accept anything that would impair their professional judgement.
c)Disclose all material facts that would distort any report. / 25
Do internal auditors avoid any conflict of interest, whether apparent or actual? / / Auditors sign declaration of interest.
Auditors sign the Audit Code of Conduct which covers the need to make a balanced assessment. To be able to do that auditors should not:-
a)participate in any activity or relationship that would impair that unbiased attitude.
b)Accept anything that would impair their professional judgement.
c)Disclose all material facts that would distort any report.
Work is assigned by audit managers with declarations of interest/ any previous conflicts etc. in mind. / 26
1130 Impairment to Independence or Objectivity
If there has been any real or apparent impairment of independence orobjectivity, has this been disclosed to appropriate parties (depending on the nature of the impairment and the relationship between the CAE andsenior management/the board as set out in the internal audit charter)? / / There have been no cases where there has been any impairment of independence or objectivity. In the event of any such impairment, such a disclosure would be made. / 27
Have internal auditors assessed specific operations for which they havebeen responsible within the previous year? / / All auditors have been in current post for 6+years therefore there could be no conflict of interest when undertaking an audit engagement. / 28
If there have been any assurance engagements in areas over which theCAE also has operational responsibility, have these engagements been overseen by someone outside of the internal audit activity? / / Recent instance was VAT audit arrangements are in place for this type of audit to be overseen by Head of Service however wasn’t required in this instance as there was no disagreement over any findings. Scope of work was set by Audit Team Manager with no influence from CAE. / 29
LGAN / Are assignments for ongoing assurance engagements and other auditresponsibilities rotated periodically within the internal audit team? / / Internal Audit is a small team so will not always be possible to rotate especially where specialist skills are required, e.g. computer audits. / 30
LGAN / Have internal auditors declared interests in accordance with organisational requirements? / / Those involved in investigations complete the corporate form as well as the audit form. All auditors complete the audit form. / 31
LGAN / Where any internal auditor has accepted any gifts, hospitality, inducements or other benefits from employees, clients, suppliers orother third parties (other than as may be allowed by the organisation’sown policies), has this been declared and investigated fully? / / There has been no acceptance of gifts etc. to declare and therefore no instances to investigate. / 32
LGAN / Have any instances been discovered where an internal auditor has used information obtained during the course of duties for personal gain? / / There have been no instances where internal auditors have used for personal gain. / 33
LGAN / Have internal auditors disclosed all material facts known to them which, if not disclosed, could distort their reports or conceal unlawful practice, subject to any confidentiality agreements? / / Some declarations have been made and these appear reasonable. / 34
LGAN / Have internal auditors complied with the Bribery Act 2010? / / Employee responsibilities under this Act is specifically referred to in the Employee Code of Conduct. This is also covered in the “Integrity” section of the Auditors Code of Conduct. / 35
If there has been any real or apparent impairment of independence orobjectivity relating to a proposed consulting services engagement, wasthis disclosed to the engagement client before the engagement was accepted? / / No consulting engagements have been undertaken. / 36
Where there have been significant additional consulting services agreedduring the year that were not already included in the audit plan, wasapproval sought from the board before the engagement was accepted? / / No consulting engagements have been undertaken. / 37
3.3 / 1200 Proficiency and Due Professional Care
1210 Proficiency
Does the CAE hold a professional qualification, such as CMIIA/CCAB or equivalent? / / CIPFA / 38
Is the CAE suitably experienced? / / Extensive experience in local government finance / 39
LGAN / Is the CAE responsible for recruiting appropriate internal audit staff, in accordance with the organisation’s human resources processes? / / 40
LGAN / Does the CAE ensure that up-to-date job descriptions exist that reflectroles and responsibilities and that person specifications define therequired qualifications, competencies, skills, experience and personal attributes? / / Whilst job descriptions specifically may need updating we have a competency framework in place which identifies specific roles which is assessed as part of the appraisal process. / 41
Does the internal audit activity collectively possess or obtain the skills, knowledge and other competencies required to perform itsresponsibilities? / / Competency Framework / 42
Where the internal audit activity does not possess the skills, knowledge and other competencies required to perform its responsibilities, does the CAE obtain competent advice and assistance? / / Currently no skill etc. shortages. If this was to occur a case would be made to HoS/Corporate director to obtain additional resources. / 43
Do internal auditors have sufficient knowledge to evaluate the risk offraud and anti-fraud arrangements in the organisation? / / Revised counter fraud strategy discussed at Audit team meeting 11th Feb 2014.
Identifying fraud risks was subject of a presentation during Internal Audit Training Day 4th December 2013.