Agenda item

Considered –

The annual report of the Head of Internal Audit which summarised the internal audit work performed during the year ended 31 March 2021, set out the opinion of the Head of Internal Audit on the overall framework of governance, risk management and control in place within the County Council, and advised of Veritau’s conformance to professional standards and the conclusions arising from the Quality Assurance and Improvement Plan.

Max Thomas (Head of Internal Audit) introduced the report, highlighting the following:-

(a)  His opinion regarding the overall framework of governance, risk management and control in place within the County Council was “Substantial Assurance”.  He had placed no reliance on the work of other assurance bodies in coming to that opinion.

(b)  The full impact of the Coronavirus pandemic was not yet known, although Veritau had identified no particular issues through its audit work.

(c)   There was one significant control issue of relevance to the preparation of the 2020/21 Annual Governance Statement.  That issue was Information Security.  This had been identified in the previous year, and for a number of years.  The County Council was undertaking a lot of work to try to mitigate the risks around Information Security, although it remained a significant risk for the County Council.

Members questioned Max Thomas on the following issues:-

·         David Portlock asked Max Thomas how he had avoided giving a “Limited Assurance” or “Limited Scope” opinion when Veritau had undertaken no audit work during the first quarter of the year, 7 audit reports were still in draft and had not yet been finalised, and, in respect of Central Services, only two reports had been issued in the year.  Max Thomas responded that CIPFA had provided guidance to Heads of Internal Audit, which he had followed.  He had taken the view that the County Council, before the pandemic, had been in a very strong position and Veritau had no significant concerns about controls or risk management within the County Council.  Internal Audit work had been paused during the pandemic but had not stopped altogether.  Instead Veritau had put a lot of resources into providing advice and supporting County Council services.  Throughout the year, Veritau had been engaged with the County Council’s senior management and there was nothing which had suggested that the framework was not as good as previously.  Max Thomas added that, in his view, the County Council had responded incredibly well to the pandemic.  Whilst Veritau had issued fewer final reports during the year compared to previous years, assurance could still be taken from audit work at draft report stage or where fieldwork was substantially complete.  Nothing had been identified which suggested that there were major issues.

·         At Members’ request, Max Thomas provided examples of “flexible audit planning arrangements”.  He explained that it was a new approach which was being used by many Internal Auditors across the country and meant that, rather than having a very detailed audit plan drawn up some months before the start of the year, there was a much more high level work programme which would be continually reviewed and updated.  Under the new approach, Veritau would prioritise work to align with the County Council’s risks and consequently some audits that were originally in the work programme might be dropped and other audits would come in.  Many of the audits would be shorter and more focused than previously, making for a more flexible audit process which hopefully would provide greater benefit and value to the to the County Council.  Max Thomas added that, in terms of reporting back to the Audit Committee, he envisaged that Veritau would provide more detail on the prioritisation and re-prioritisation of Veritau’s work programme to ensure that the Committee would know what Veritau was working on at that time, in the near future, and later in the year.  This would inform the Committee of the focus of Internal Audit work.

Resolved –

(a)  That the “Substantial Assurance” opinion of the Head of Internal Audit regarding the overall framework of governance, risk management and control operating within the County Council, as set out in Appendix 1 to the report, be noted.

(b)  That the significant control issue which is recommended for inclusion in the 2020/21 Annual Governance Statement be noted.

(c)   That the outcome of the quality assurance and improvement programme and the confirmation that the Internal Audit Service conforms with the Public Sector Internal Audit Standards be noted.