200612AuCteePaper1Annex12021DraftInternal Audit Plan200527
Cairngorms National Park Authority Internal Audit Plan – 2020⁄21
DRAFT
April 2020
Table of Contents
- Introduction
- Internal Audit Approach
- Proposed Internal Audit Plan
- Delivering the Internal Audit Plan
- Quality Assurance and Improvement
- Appendix 1 – Strategic Internal Audit Plan 2020 – 23
- Appendix 2 – Strategic Risk Register
- Appendix 3 – Audit Timetable
- Appendix 4 – Internal Audit Universe
- Appendix 5 – Internal Audit Charter
Introduction
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, internal control and governance processes.
Section 3 – Definition of Internal Auditing, Public Sector Internal Audit Standards
Scott-Moncrieff’s internal audit methodology complies with the Public Sector Internal Audit Standards (PSIAS), which cover the mandatory elements of the Chartered Institute of Internal Auditors’ International Professional Practices Framework.
Internal Audit Plan
The PSIAS require the Chief Internal Auditor to produce a risk-based plan, which takes into account Cairngorms National Park Authority’s risk management framework, its strategic objectives and priorities, and the views of senior managers and the Audit and Risk Committee.
The objective of audit planning is to direct audit resources in the most efficient manner to provide sufficient assurance that key risks are being managed effectively and value for money is being achieved.
This paper sets out a detailed plan for 2020⁄21 in the context of a three-year Strategic Internal Audit Plan.
Audit and Risk Committee Action
The Audit and Risk Committee are asked to review and, if content to do so, approve this Internal Audit Plan for 2020⁄21.
Once finalised, this plan can be reviewed and revised at any time to reflect changes in Cairngorms National Park Authority’s risk profile and assurance requirements. Any significant changes will be subject to Audit and Risk Committee approval.
Internal Audit Approach
Supporting the Governance Statement
The main purpose of the internal audit plan is to provide Cairngorms National Park Authority (CNPA), through the Audit and Risk Committee, with the assurance it needs to prepare an annual Governance Statement that demonstrates good practice in corporate governance, risk management and internal control. We also aim to support continuous improvement in these areas by making constructive and practical recommendations.
Risk Based Internal Auditing
Our methodology links internal audit activity to the organisation’s risk management framework. This helps deliver a strategic, targeted internal audit function that focuses on the key risk areas and delivers value for money.
By focussing on the key risk areas, internal audit should be able to conclude that:
- Management has identified, assessed and responded to the key risks
- The responses to risks are effective but not excessive
- Where residual risk is unacceptably high, further action is being taken
- Risk management processes are monitored by management to ensure they continue to operate effectively, and
- Risks, responses and actions are properly classified and reported.
Audit Needs Assessment
Internal audit plans are based on an assessment of audit need. “Audit need” represents the audit assurance required by the Audit and Risk Committee and senior management that the control systems established to manage and mitigate the key inherent risks are adequate and operating effectively. The objective of the audit needs assessment is therefore to identify these key controls systems and determine the internal audit resource required to provide assurance on their effectiveness.
Our audit needs assessment takes both a top-down and bottom-up approach followed by a reasonableness check. The top-down approach involves identifying the areas of highest inherent risk and the control systems in place to manage those risks. The bottom-up approach involves defining CNPA’s audit universe (potential auditable areas) and covering all systems on a cyclical basis in line with their relative risk and significance. The reasonableness check involves us using our experience of similar organisations to ensure that all key risk areas and systems have been considered and the resulting internal audit plan is appropriate.
Our audit needs assessment involved the following activities:
- Reviewing the corporate risk register,
- Reviewing the CNPA corporate plan 2018 — 2022,
- Reviewing previous internal audit reports,
- Reviewing external audit reports and plans,
- Reviewing the CNPA website and internal policies and procedures,
- Discussions with the Chief Executive, Senior Management and the Audit and Risk Committee.
The audit needs assessment is revised on an ongoing basis (at least annually) to take account of any changes in CNPA’s risk profile. Any changes to the internal audit plan are approved by the Audit and Risk Committee.
Best Value
Our internal audit work helps CNPA to determine whether services are providing best value. This plan contains reviews that focus on assessing whether the current processes provide best value, as a core aspect of each audit. Where we identify opportunities for improving value for money, we raise these with management and include them in the report action plan.
Proposed Internal Audit Plan
Appendix 1 presents the internal audit plan for 2020÷21−2022÷23
As our internal audit approach is based on risk, the proposed plan is also cross-referenced to the strategic risk register, which is included in Appendix 2 for reference.
We seek to complement the areas being covered by external audit. This helps us to target our work in the most effective manner, avoiding duplication of effort and maximising the use of the total audit resource.
The table below demonstrates how the internal audit plan days agreed for 2020⁄21 have been allocated across each area of the audit universe:
(Insert chart from page 7 here)
Delivering the Internal Audit Plan
Internal Audit Charter
Appendix 5 sets out our Internal Audit Charter, which details how we will work together to deliver the internal audit plan.
Internal Audit team – Indicative Staff Mix
(Insert table from page 8 here)
Confirmation of Independence
PSIAS require us to communicate on a timely basis all facts and matters that may have a bearing on our independence.
We can confirm that the staff members identified to complete the reviews in the annual plan are independent and their objectivity has not been compromised.
Internal Audit Team – Key Contacts
(Insert contact information from page 8 here)
Quality Assurance and Improvement
Key Performance Indicators
As set out in our Internal Audit Charter, we assess our performance in three ways:
- On-going internal monitoring of performance
- Periodic internal assessment
- Periodic external assessment.
The proposed KPIs we will work to are:
(Insert table from page 9 here)
Performance Reporting
We will report on any issues/exceptions arising from the KPI monitoring within the progress reports presented to the Audit and Risk Committee. We will also share relevant information on the periodic internal and external quality assessments as they are undertaken.
Appendix 1 – Internal Audit Plan 2020 – 23
(Insert table from pages 10 – 13 here)
Appendix 2 – Strategic Risk Register
(Insert table from pages 14 – 21 here)
Appendix 3 – Audit Timetable
(Insert table from page 22 here)
Appendix 4 – Internal Audit Universe
(Insert table from pages 23 – 27 here)
Appendix 5 – Internal Audit Charter
Internal auditing is an independent and objective assurance and consulting activity that is guided by a philosophy of adding value to improve the operations of Cairngorms National Park Authority (CNPA).
It helps CNPA accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
Aim
The aim of this Charter is to set out the management by all parties of the internal audit process. The Charter sets out the context of the internal audit function, including the place of the Audit and Risk Committee, the key personnel, timescales and processes to be followed for each internal audit review.
Role
The internal audit activity is established by the Audit and Risk Committee on behalf of the Board. The internal audit activity’s responsibilities are defined by the Audit and Risk Committee as part of its oversight role.
Professionalism
The internal audit activity will adhere to Public Sector Internal Audit Standards (PSIAS), which are based on mandatory guidance of The Chartered Institute of Internal Auditors (CIIA) including the Definition of Internal Auditing, the Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing. The CIIA’s Practice Advisories, Practice Guides, and Position Papers will also be adhered to as applicable to guide operations. In addition, the internal audit activity will adhere to CNPA’s relevant policies and procedures and the internal audit activity’s standard operating procedures manual.
Authority
The internal audit activity, with strict accountability for confidentiality and safeguarding records and information, is authorised full, free, and unrestricted access to any and all of CNPA’s records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist the internal audit activity in fulfilling its roles and responsibilities. The internal audit activity will also have free and unrestricted access to the Audit and Risk Committee.
Accountability
The Chief Internal Auditor will be accountable to the Audit and Risk Committee and will report administratively to the Director of Corporate Services.
The Audit and Risk Committee will approve all decisions regarding the performance evaluation, appointment, or removal of the Chief Internal Auditor.
The Chief Internal Auditor will communicate and interact directly with the Audit and Risk Committee, including between Audit and Risk Committee meetings as appropriate.
Independence and Objectivity
The internal audit activity will remain free from interference by any element in CNPA, including matters of audit selection, scope, procedures, frequency, timing, or report content. This is essential in maintaining the internal auditors’ independence and objectivity.
Internal auditors will have no direct operational responsibility or authority over any of the activities audited. Accordingly, they will not implement internal controls, develop procedures, install systems, prepare records, or engage in any other activity that may impair internal auditor’s judgment.
Internal auditors must exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. Internal auditors must make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgements.
The Chief Internal Auditor will confirm to the Audit and Risk Committee, at least annually, the organisational independence of the internal audit activity.
Scope and Responsibility
The scope of internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation’s governance, risk management, and internal control processes in relation to the organisation’s defined goals and objectives. Internal control objectives considered by internal audit include:
- Consistency of operations or programmes with established objectives and goals
- Effectiveness and efficiency of operations and use of resources
- Compliance with significant policies, plans, procedures, laws, and regulations
- Reliability and integrity of management and financial information processes, including the means to identify, measure, classify, and report such information.
- Safeguarding of assets.
Internal Audit is responsible for evaluating all processes (‘audit universe’) of CNPA, including governance processes and risk management processes. In doing so, internal audit maintains a proper degree of coordination with external audit.
Internal audit may perform consulting and advisory services related to governance, risk management and control. It may also evaluate specific operations at the request of the Audit and Risk Committee or management, as appropriate.
Based on its activity, internal audit is responsible for reporting significant risk exposures and control issues identified to the Audit and Risk Committee and to senior management, including fraud risks, governance issues, and other matters needed or requested by CNPA.
Annual Internal Audit Plan
The audit year runs from 1 April to 31 March.
At least annually, the Chief Internal Auditor will submit to the Audit and Risk Committee an internal audit plan for review and approval. The internal audit plan will detail, for each subject review area:
- The outline scope for the review,
- The number of days budgeted,
- The timing, including which Audit and Risk Committee the final will report will go to,
- The review sponsor.
The internal audit plan will be developed based on a prioritisation of the audit universe using a risk-based methodology, including input of senior management. Prior to submission to the Audit and Risk Committee for approval, the plan will be discussed with senior management. Any significant deviation from the approved internal audit plan will be communicated through the periodic activity reporting process.
Assignment Planning and Conduct
An assignment plan will be drafted prior to the start of every assignment setting out the scope, objectives, timescales and key contacts for the assignment.
Specifically, the assignment plan will detail the timescales for carrying out the work, issuing the draft report, receiving management responses and issuing the final report. The assignment plan will also include the name of the staff member who will be responsible for the audit (review sponsor) and the name of any key staff members to be contacted during the review (key audit contact).
The assignment plan will be agreed with the review sponsor and the key audit contact (for timings) before the review starts.
The internal auditor will discuss key issues arising from the audit as soon as reasonably practicable with the key contact and/or review sponsor, as appropriate.
Reporting and Monitoring
A written report will be prepared and issued by the Chief Internal Auditor or designee following the conclusion of each internal audit engagement and will be distributed to the review sponsor and key contacts identified in the assignment plan for management responses and comments.
Draft reports will be issued by email within 15 working days of fieldwork concluding. The covering email will specify the deadline for management responses, which will normally be within a further 15 days. The management comments and response to any report will be overseen by the review sponsor.
The internal auditors will issue the final report to the review sponsor and the Director of Corporate Services. The final report will be issued within 10 working days of the management responses being received. Finalised internal audit reports will be presented to the Audit and Risk Committee. Finalised internal audit outputs must be in the hands of the committee secretary in line with the formal papers deadline set before each meeting.
The working days set out above are maximum timescales and tighter timescales may be set out in the assignment plan.
The internal audit activity will follow-up on engagement findings and recommendations. All significant findings will remain in an open issues file until cleared.
Audit and Risk Committee
The Audit and Risk Committee meets throughout the year. Dates for Audit and Risk Committee meetings will be provided to internal audit as soon as they are agreed. The Chief Internal Auditor and/or Internal Audit Manager will attend all meetings of the Audit and Risk Committee.
Internal audit will schedule its work so as to spread internal audit reports reasonably evenly over the Audit and Risk Committee meetings. The annual internal audit plan will detail the internal audit reports to be presented to each Audit and Risk Committee meeting.
The Internal Auditor will generally present specific reports to the committee as follows:
(Insert table from page 31 here)
The Audit and Risk Committee will meet privately with the internal auditors at least once a year.
Periodic Assessment
The Chief Internal Auditor is responsible for providing a periodic self-assessment on the internal audit activity as regards its consistency with the Audit Charter (purpose, authority, responsibility) and performance relative to its Plan.
In addition, the Chief Internal Auditor will communicate to senior management and the Audit and Risk Committee on the internal audit activity’s quality assurance and improvement programme, including results of on-going internal assessments and external assessments conducted at least every five years in accordance with Public Sector Internal Audit Standards.
Review of Charter
This Charter will be reviewed by both parties each year and amended if appropriate.
(End of Document)