Agenda item

To present the report of the Head of Audit and Risk.

The report of the Head of Audit and Risk incorporating the Internal Audit Strategy for 2024/25 was presented for the Committee’s consideration.

The Head of Audit and Risk presented the report and strategy as risk based with resources directed to the highest areas of risk in line with the strategic risk register (Details of proposed audits were set out in Appendix A to the strategy).Whilst the strategy has been set in consultation with the Director of Function (Resources)/Section 151 Officer and Heads of Service, Internal Audit will continue to engage with senior management over the course of the plan to ensure the service remains up to date and responsive to any emerging issues and concerns.

Points of discussion by the Committee –

·      In light of the two vacancies within the Internal Audit service, whether there is appropriate reconciliation between the work planned and the resources available and whether the balance between in-house and third-party resources meets the requirements given that there is only one scheduled audit requiring external commissioned expertise in relation to cyber security.

·      Recruitment arrangements and succession planning within the Internal Audit Service. Some concern was expressed regarding the implications for the future of the service and the development of the next generation of internal auditors if entry into the service at Anglesey is at senior level.

·      Whether introducing a system of auditor- accountant rotation might be helpful in addressing internal audit recruitment challenges.

·      Given that one of the stated objectives of the Internal Audit Service is to provide effective challenge and act as a catalyst for positive change and continual improvement, there is no reference in the planned work to how this objective will be delivered or the role   Internal Audit might have in providing independent input into service transformation and change.

·      The propriety of the Committee escalating recruitment and resource issues for management/Executive attention.

The Committee was advised as follows –

·      That the Internal Audit Service does have recourse to an external auditor who undertakes some of the complex strategic risk register audits in addition to the inhouse Principal and Senior Auditors. The proposed internal audit coverage also includes non-strategic risk areas which are detailed under the category of other audit work.

·      That regarding staffing and recruitment, the Internal Audit function has changed considerably in recent years and as resources have reduced the ways in which internal audit works have had to change to ensure the organisation obtains the best value from those limited resources which is a trend that is being replicated across services. Lower level/scale posts are therefore becoming obsolete because the work carried out at this level does not add value to the organisation.

·      That there may be greater opportunities in larger internal audit teams for graduate trainees to gain shadowing experience but for Anglesey’s Internal Audit Service it is more effective, efficient, and better value for money to commission skilled and experienced auditors from outside the organisation to supplement existing inhouse resources where required. Additionally, external audit provides an assessment of the adequacy of internal audit arrangements.

·      That the main focus of Internal Audit is to provide assurance, and although it can also act as a critical friend and provide challenge (Internal Audit’s contribution to the Housing Service’s review of its approach to procurement was cited), change management is managed by the services and each service has its own Business Manager to scrutinise and improve business practices and processes. Larger corporate change projects are managed by the Corporate Transformation Service.

·      That rotating auditor and accountants would be a challenge as each role has its own different skillset.

·      That the Committee’s role is to highlight areas of risk that have the potential to become issues for the Council and to bring those to the attention of the Executive or management.

The Head of Audit and Risk advised that internal audit capacity is not at a point requiring escalation, and she confirmed that internal audit has the necessary resources to deliver the strategy and to provide an assurance opinion.

The Committee further suggested that it might be helpful to ask the Head of Audit and Risk to raise the issue of capacity/recruitment at the Wales Chief Auditors Group. The Head of Audit and Risk advised that Denbighshire Council has established a working group to examine the feasibility of sharing audit resources between the six North Wales councils.

It was resolved that the Governance and Audit Committee –

·      Approves the risk-based Internal Audit Strategy 2024/25 as providing the Council with the assurance it needs.

·      Confirms that it is content with internal audit’s resource requirements and the use of other sources of assurance.

·      Confirms that it is content that there are no inappropriate scope or resource limitations.