Agenda item

To consider a report by the Chief Internal Auditor (copy attached).

 

The Chief Internal Auditor, Bob Chowdhury, introduced the Internal Audit External Audit Assessment 15 April 2024 report. 

 

The Lead Member for Finance, Performance and Strategic Assets, Councillor Gwyneth Ellis and the Corporate Manager, Internal Audit, Ceredigion County Council, Alex Jenkins, were in attendance for the item.

 

The external assessment could be completed either by a full external assessment, or an internal self-assessment which was validated by an external assessment reviewer.  As a member of the Welsh Chief Auditor Group (WCAG) it was agreed to adopt the self-assessment approach with another member of the WCAG undertaking the independent validation.   On completing the self-assessment, the information was shared with the Corporate Manager, Internal Audit at Ceredigion County Council who had completed the external assessment and provided a report.

 

The Corporate Manager, Internal Audit, Ceredigion County Council gave a summary of the assessment (previously circulated). 

 

The Chair thanked Alex Jenkins, Bob Chowdhury and the Internal Audit team together with Councillor Gwyneth Ellis for all their hard work.

 

Within the report it stated that Internal Audit generally conforms with the requirements and generally conforms reflects the highest level of performance following an external assessment. 

 

The assessment was set for standards for all Local Authorities within the United Kingdom which derived from international internal audit standards ultimately set by the Global Institute of Internal Audit. 

 

During discussions, the following points were raised and discussed –

·         Within the report, it was noted effective partnership working with other auditors and other local authorities. 

·         Capacity  issues were raised not only within Denbighshire County Council (DCC) but across other areas.  Where did DCC sit when benchmarking its performance against others in Wales.  Secondly whether consistent challenges faced those Authorities regarding the ability to recruit and retain staff in key roles in this area.  Part of the report reflected those challenges which DCC Internal Audit had faced.   The Chief Internal Auditor, Bob Chowdhury, responded that when a benchmarking exercise had been carried out approximately 18 months previously, the 22 local authorities had been looked at together with the make-up of the teams.  It was confirmed that across Wales it had been very difficult to recruit internal audit staff.  There was a shortage of staff available within Wales and DCC sat midway of all areas.  DCC Internal Audit comprised of a team of 6 members.  Salary payment was midway of all  22 local authorities.  Qualification wise, DCC were lower than a lot of the Welsh local authorities due to 3 career path auditors being recruited during the last 18 months.  The Principal Auditor was on a career pathway. 

 

Alex Jenkins supported the statement given by Bob Chowdhury and explained that Ceredigion was similar to DCC.   It was a common question around staffing.  In Ceredigion they were staffed to full complement but it was the qualifications, as they currently had 2 people studying for the certified internal audit qualification. 

 

Regarding the recruitment of staff, since the pandemic, staff were continuing to work from home and, therefore, were able to, for example, live in North Wales but work for one of the London Councils because staff were only required to attend in the office for 1 or 2 days per week and that had affected recruitment.

 

The way forward for DCC had been to recruit at the lower level and over the course of 4-5 years they could become fully qualified internal auditors. 

 

Within the North Wales Audit Group and the All Wales Group common themes were discussed and working papers were shared which did speed up the work carried out in North Wales.

 

It was confirmed that Audit Wales ran an apprenticeship and graduate trainee scheme to respond to the risk as it was challenging due to working from home and the ability to work for larger Authorities whilst continuing to live in a different area.  Audit Wales has approximately 50 people on those schemes at any one time and as part of the scheme there was an opportunity to second people to go and work in other public sector bodies.  It was unusual for staff to be seconded to Councils due to the Auditor Generals independence but includes working for example, DVLA.  Audit Wales also try to support the public sector within the limitations of the Auditor Generals independence.  We agree there is a challenge recruiting into the audit sector. 

 

·         It was questioned how many staff work in Internal Audit and how did the training carried out together with the work which was required to be done.

 

Within the internal audit team of DCC there were 6 members of staff.  The team were made up of the Chief Internal Auditor, Principal Auditor, 3 career pathways and an Auditor.  The training plan for team were Principal Auditor due to complete ILM4 which was a management qualification which should be completed by the end of this year.  Once that was complete she would complete her Institute of Internal Auditor certified qualification which she has part completed.  One senior Auditor who had been with DCC almost 2 years.  She was to start the Institute of Internal Auditor examinations.  2 of the career pathways had just completed the first level of the Association of Accounting Technicians examinations. 

 

Alex Jenkins confirmed the team in Ceredigion comprised of herself (Corporate Manager of Internal Audit), Audit Manager, Senior Auditor and 2 Auditors. 

 

·         The Chair asked about Standard 1210 Proficiency and Due Professional Care.  It was stated within the report that the Council showed significant support for the internal audit function  achieving its required qualifications for proficiency as soon as possible.  

 

The Chief Internal Auditor confirmed the Council were supporting the Internal Audit team.   In January 2023 when recruitment was taking place DCC informed the team to put out 2 adverts one for senior auditor and one for a career pathway post.  HR were supportive throughout the process.  Unfortunately, no applications for the Senior Auditor were received but a number of applications were received for the career pathways post.  HR have assisted with training plans which were now in place.  The budget was also in place for when different levels of training was to be paid for. 

 

Partial conforming was stated for this part of the assessment as the Chief Internal Auditor was a fully qualified CIPFA Accountant then the remainder of the team do not have the qualifications but the Principal Auditor is part qualified in IIA certified, and one member of staff AAT qualified.  The remaining 2 members of staff have not worked in finance previously but they are doing the Association of Accounting Technicians qualification and that was the reason for partial conforming.

 

·         Risk Management -  it was stated that it was not clear how the prioritisation of the remainder of the audit work aligns to the organisation goals and corporate risks.  How was this going to be worked on in the future.  It would be useful for the Committee to know how Internal Audit plan their work. 

 

When the Risk Management review was commenced in March some of the comments made by Alex Jenkins had been taken on board and the risk process had been looked at.  It covered a lot of the issues which had been raised in the assessment.  Risk Management had fallen behind as in January 2023 there had only been the Chief Internal Auditor, Principal Auditor and an Auditor of a team of 6 so the plan had not been completed that year and Risk Management had dropped behind.  When Alex had carried out the assessment, Risk Management had been on the plan but at the very end so she did not see what work was being carried out.  The work is now completed and the report will be finalised within the next week. 

 

·         Managing the risk of fraud.  Low incidents of fraud.  In a future report it was requested that Internal Audit state how the work would be carried out to link in to the mitigation of the corporate risk. 

 

For the past 12 months an online learning platform had been looked at for corruption, fraud, and bribery.  2 or 3 options had been looked at and last week a meeting had taken place with the whole of North Wales and received a presentation from a company.  The presentation was good, it covered all the areas of fraud risk and corruption which was needed.  The Chief Internal Auditor confirmed Ynys Mon and 2 other local authorities, together with DCC, had shown an interest and were looking at bringing that platform to Denbighshire.  There was a cost of the online learning package.   All staff, members and lay members would be able to go on to the e-learning platform and would then understand about fraud and corruption.  The next step would be to look at the policies and procedures and update them in line with the training provided.  Within the next 12-18 months all staff should have completed the e-learning session and that would go towards improving DCC’s awareness.

 

·         An update report would be submitted to Governance and Audit Committee probably in six months’ time.  The Internal Audit Quarterly report would be submitted in September/October and information would be included with an update and share the actions again to members.   The Action Plan would be shared to all members following the current meeting. 

 

RESOLVED that the Governance and Audit Committee considered the actions contained within the Internal Audit External Quality Assessment and monitor progress made to complete the actions and fully conform.