PAPER D

Committee: AUDIT COMMITTEE

Date: 16 MARCH 2006

Title: STRATEGIC PLAN FOR INTERNAL AUDIT

REPORT OF THE CHIEF INTERNAL AUDITOR

___________________________________________________________________

PURPOSE

1. The purpose of this report is to inform the Audit Committee of the proposed internal audit activity for the next three years.

BACKGROUND

2. The council is the largest employer on the island, spending and receiving over £300 million per annum and employing around 5,000 staff. In addition, it manages its own pension fund valued at £150 million. The council seeks to achieve its objectives through the maintenance of a comprehensive system of risk management that should ensure that services are delivered in a proper, economic, efficient and effective manner. Internal audit’s role is to assess the adequacy and effectiveness of the risk management system and in particular the quality of the internal control arrangements designed to mitigate risks. Internal audit is part of the control regime and being a finite resource, needs to plan and allocate resources in a rational and systematic way in order to ensure that all the council’s activities receive an appropriate amount of attention.

3. The strategic audit plan that is attached to this report at Appendix A is the result of a systematic planning process that has involved:

v A risk assessment process using weighted risk factors

v Consultation with stakeholders including heads of service and the audit commission.

4. The plan sets out the specific activities to be audited, the audit approach to be adopted and the time needed to execute the audit. Clearly, there are some activities and systems that need to be audited more frequently than others. The approach to auditing the council’s main financial systems will change in 2006/07 onwards. This is due to the implementation of International Standards for Auditing by the Audit Commission, our external auditors. They will continue to seek to rely on the work of internal audit as far as is possible and in order to maximise the extent of that reliance, internal audit will have to adopt the same auditing methodology used by the Commission.

5. Existing audit resources, after making allowances for training and other indirect activity are included in summary in the plan. The number of available days totals 1,339 which broadly matches the perceived audit need as depicted in the plan.

6. The audit panel is requested to :

(i) endorse the methodology used to construct the audit plan;

(ii) consider the relative priorities, frequencies and amounts of time devoted to areas of council activity;

(iii) make recommendations about the priorities of the audit teams work.

RELEVANT PLANS, POLICIES, STRATEGIES AND PERFORMANCE INDICATORS

7. None

CONSULTATION PROCESS

8. The strategic plan has been consulted on with Heads of Service, Strategic Directors and the Audit Commission.

BACKGROUND PAPERS USED IN THE PREPARATION OF THIS REPORT

9. Audit planning file held by G. Richardson

Contact point: G B Richardson, Chief Internal Auditor, ( 823683

G B RICHARDSON

Chief Internal Auditor

Foreword

STRATEGIC AUDIT PLAN 2006 – 2009

1. INTRODUCTION

Internal Audit is a statutory function for which the council must make provision under the Accounts and Audit Regulations 2003. The council has delegated this responsibility to an Assistant Chief Executive, who is the council’s responsible financial officer under section 151 of the Local Government Act 1972 for the proper administration of the council’s financial affairs.

The council’s statutory duty to ensure probity and value for money in the conduct of its business is achieved through the maintenance of a comprehensive system of risk management and internal control. The system of internal control is comprised of policies, plans and control procedures designed and applied to ensure that the council’s objectives are met. Internal audit is part of this control regime which, through its status, professionalism and organisational independence should be able to offer an independent and objective appraisal of the adequacy and effectiveness of the risk management and internal control system in supporting the achievement of organisational objectives.

2. LINKS WITH THE COUNCIL’S CORPORATE OBJECTIVES

To be effective internal audit needs to plan its work having regard to the key organisational objectives as set out in the change management plan Aim High. The audit plan is organised under the five corporate objectives as set out in the Aim High document. A further dimension to audit’s effectiveness is to take account of the relative risks associated with the councils business since audit resources are finite and must be distributed in some rational way. Much of the plan is therefore designed to prevent things going wrong by pro-actively testing that the council’s arrangements for managing risks are effective in delivering organisational objectives. Individual audits have been risk assessed using a risk assessment tool that ranks each audit project against a series off weighted risk criteria producing a risk score for each audit.

3. CONSULTATION

Equally, it is important that the plan is not produced in isolation without major stakeholders having the ability to influence the plan’s content and relative priorities. This plan has been developed in consultation with senior managers in all directorates, because managers and administrators in directorates are ultimately responsible for achieving control. It is they who know what potentially can go wrong, understand their particular subject best of all and know what developments are coming in the future. The plan therefore takes account of the views of those being audited, especially in terms of developing issues, the preferred timings of audits and the amount of time that directorates feel is appropriate for particular areas.

The Audit Commission (the Council’s external auditor) is one of the key stakeholders of our service and has also been consulted about the plan. They rely heavily on our assurance work regarding core financial systems to enable them to place reliance on the outputs and hence complete their audits of the published financial statements in a timely and efficient manner. Following the adoption of the International Standards for Auditing by the UK Accountancy profession, the Audit Commission have introduced a radically different methodology for auditing financial and other information systems that support the production of the authority’s financial statements. In order to maximise the extent of reliance that the Audit Commission can place upon the work of internal audit, internal audit will adopt the same methodology for financial systems work.

4. CONTRACTING

There is provision in the plan to support the contracting process. Our traditional role has been to test the effectiveness of controls that operate within the whole tendering and contracting process. We intend to continue to concentrate on this aspect of our work but if the need arises for us to become more directly involved in any one particular procurement process, we shall.

5. INFORMATION TECHNOLOGY

There is an increasing need to pay particular attention to developments in Information Communications Technology (ICT). The plan makes provision for using an internationally recognised set of ICT audit standards called COBIT to assess all aspects of the management arrangements over the ICT function over the three years plan period. The team is in the process of filling a vacancy for the post of the ICT Auditor which will ensure that the Council can fulfil its ICT audit needs.

6. RESOURCES

At the front of the attached strategic plan is a table showing how the expected productive time for financial year 2006/07 was computed, taking account of unavoidable lost time such as annual leave and bank holidays. This shows that inter alia, we expect an average productive contribution of 181 days per staff member. The content of the plan has been prepared in the context of existing staff resources augmented by an additional two trainee auditors that we anticipate recruiting in the summer, and the ICT Auditor referred to above.

7. CONCLUSION

This document sets out where internal audit will direct its attention over the next three years based on existing resources. It includes information on the risk rating of the audit, the frequency of review, and the estimated time budget to perform the assignment. The Plan looks ahead for three years and although care has been taken to make it as relevant and up to date as possible, it will inevitably change.

GB Richardson

Chief Internal Auditor

March 2006

Expected Resources 2006/07
	ICT
	AUDITOR	CIA	AUDITOR	AUDITOR	AUDITOR	AUDITOR	TRAINEE	TRAINEE	ADMIN.	TOTAL
Total Days Available	238	260	211	235	260	260	195	195	65	1919
Less:
Annual Leave	20	25	21	35	26	20	15	15	5.5	182.5
Bank Holidays	11	11	9	11	11	11	8	8	5	85
Training	10	10	10	10	10	10	20	20	1	101
Management		50								50
Administration	12	15	12	12	12	12	9	9	30	123
Sickness	5	5	5	5	5	5	4	4	1	39
Total Indirect Time	58	116	57	73	64	58	56	56	42.5	580.5
Net Productive Time	180	144	154	162	196	202	139	139	22.5	1338.5
Productivity % excl A/L and B/H	87	64	85	86	88	88	81	81	41	81
Productivity %	76	55	73	69	75	78	71	71	35	70
Average WTEs	7.38
Average Productive Days WTE	181.35

INTERNAL AUDIT STRATEGIC PLAN 2006-2009
SUMMARY OF TIME ALLOCATIONS.
OBJECTIVE	2006/7	2007/8	2008/9
	DAYS	DAYS	DAYS
2.3.1 Regeneration	155	122	140
2.3.2 Health and Well Being	80	108	83
2.3.3 Safer Communities	40	75	60
2.3.4 Outcomes for children	153	176	166
2.4.1 High Performance	912	1018	1083
TOTAL	1340	1499	1532

Objective 2.3.1 - Drive the sustainable regeneration and development of the island
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
RISK BASED AUDITS
Overall Management Arrangements	74			10
Tourism
IW Tourism	33			10
Maintenance
Highway Maintenance	81		10
Waste Management	37			10
Cleansing and Litter Management	36	10
Public Conveniences	36	10
Electrical Services	33	10
Design
Development Control	26		10
Car Parks	42			10
Road Safety	41		10
County Transport	29			10
Rights of Way	24				10
Coastal Management
Coastal Protection	50			10
Planning
Development Team	44	10
Planning Policy	48		10
Development Control	63	10
Building Control	26			10
Countryside Services	26			10
Property Services
Industrial Sites	34			10
Building Maintenance	47	10
Property Management - New System	34		10
Energy	20	10
Aim High Objectives
Island Economy - Regeneration	60		40
Local Transport Plan 2	96	20
Strategic partnerships - Highways PFI	100	20
Tourism VFM	59	20
Economic Development	35			10
COMPLIANCE AUDITS
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
Tourism
Advertising	32		5
Call Centre	35			5
Destination Management System	35	10
Tourist Information Centres	28			10
Pop Festival	45		5
Highways
Other Highways Income	30	5
Cowes Ferry	35		5
Public Transport Support	49		5
Harbours	38	5	5	5
Vehicle Fleet	42			10
Other contracts -verges etc	38			5
Coastal Protection
SCOPAC		1	1	1
Certification checks	60	1	1	1
Coastal Management Centre	23	3
Planning
Developmental Control	63		5
Property Services
Markets	37			3
Allotments	16				3
TOTAL		155	122	140	13

Objective 2.3.2 - Improve the health and well being of island communities
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
RISK BASED AUDITS
Overall Management Arrangements	38			10
Community Development
Leisure	50		10
Libraries	39	10
Museums	33		10
Arts and Theatres	31			10
Community Learning	61	10
Events management	34		5
Adult Services
Homecare Services	52		10
Learning Disabilities	48			10
Hospital team	46	10
Older people's team	61		10
DDA	56			10
Mental Health
Management of Mental Health Services	73			10
Housing
Supporting People	50	10
Homelessness	48		10
Enforcement	34			5
Aim High Concerns
Links with Health	64	10
Over 65s outside of services	27				10
Healthier Communities	69		10
Equality and diversity	35		5
COMPLIANCE AUDITS
Leisure Centres	40	5
Sports Promotion/Grants	35		3
One Card System	24				5
Libraries	39	5
Archives	29		3
Parks and Gardens	28			3
Beaches and Esplanades	28			3
Ventnor Botanic Gardens	28	3
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
Museums	33		5
Arts and Theatres	31			5
Resource Centres	45		5
Disabled Facilities Grant	50	3
Westminster House (LD)	37		3
Home care services including alarms	52		3
Daycare Elderly/Other Services	43			3
Concessions	27		5
Fieldwork
Pooled Budgets for Nursing Care	18	1	1	1
Residential Care	54			5
CSDP/Occupational Therapists	31		5
Mental Health Day Centres	33	10
Finance and Administration
Neighbourhood Offices	38			3
Central Services
Support Services at HQ	31		5
Housing
Improvement Grants	30			5
Pan partnership	61	3
TOTAL		80	108	83	15

2.3.3 Create safer and stronger communities
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
RISK BASED AUDITS
Consumer Protection
Environmental Health General	41			10
Trading Standards	22				10
Bereavement Services	41	10
Pest Control	17				3
Dog Warden	17				3
Fire and Rescue
Overall Management Arrangements	68	10
Modernisation agenda	67	10
Emergency Planning & Community Safety
Emergency Planning & Community Safety	45		10
Safer Communities
Drug Action Team	49	10
Crime and Disorder	44			10
Aim High Concerns
Safer and stronger communities	83		20
Local decision making	46			20
Community development - forums	66		20
Town & parish councils - consultancy	41		20
COMPLIANCE AUDITS
Consumer Protection
Licensing	36			5
Administration	39			5
Fire and Rescue
Retained Firefighters Pay	41			5
Fire Safety	43		5
Ryde Training Centre	35			5
Total		40	75	60

2.3.4 - Improve outcomes for children and young people
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
RISK BASED AUDITS
Overall Management Arrangements	52	10
Education
Behavioural Support	34	10
Education Welfare	24			10
Home to School Transport	29		10
Youth and Community	30			10
Student Services	41	10
Financial Services	22				10
School Clusters	49		10
Work-force re-modelling	49	10
Extended schools	49			10
Pooled budgets/JCS	49		10
Schools Inspectorate	39		10
Children’s Services
Children’s Services	63		10
ISP/New Care Leavers Grant	37			10
Fostering and Adoption	47			10
Children’s Disability Team	33			10
Aim High Concerns
Development of a children's trust	77	10
Education Standards	78		10
Education management VFM	91		10
Compliance Audits
SCHOOLS
Primary Education
Arreton St George's CEP	30			3
Bembridge CEP	26			3
Binstead Primary	34	3
Brading CEP	30	3
Brighstone CEP	27		3
Carisbrooke CEP	30			3
St Thomas' CP	36			3
Chale CEP	27			3
Chillerton Primary	27		3
Cowes Primary	31	3
Love Lane Primary	41	3
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
East Cowes Grange Primary	37			3
Holy Cross CP	27			3
Freshwater All Saints CEP	45		3
Gatten & Lake Primary	37		3
Godshill Primary	30	3
Gurnard Primary	31	3
Hunnyhill Primary	41	3
Nettlestone Primary	30			3
Newchurch Primary	31			3
Barton Primary	35			3
Nine Acres Primary	36	3
Newport CEP	31	3
Niton Primary	27		3
Northwood Primary	25			3
Greenmount Primary	27		3
Haylands Primary	31		3
Oakfield CEP	38	3
St Mary's CP	33		3
Dover Park Primary	40		3
St Helens Primary	28	3
Sandown CEP	28			3
Broadlea Primary	34	3
St Johns CEP	27		3
Shalfleet CEP	34	3
Shanklin CEP	34			3
Weston	33			3
St Saviours CP	33	3
St Wilfrids CP	27			3
St Boniface CEP	27		3
St Margarets CEP	30		3
Whippingham Primary	31		3
Wootton Primary	27		3
Wroxall Primary	30	3
Yarmouth CEP	30			3
Summerfields Primary	38		3
Middle Schools
Archbishop King CM	32		3
Bishop Lovett CEM	37	3
Downside Middle	37		3
Forelands Middle	34	3
Lake Middle	37		3
Mayfield CEM	34		3
Trinity CEM	35			3
Nodehill Middle	40		3
Osborne Middle	43			3
Kitbridge Middle	37	3
	Risk	2006/7	2007/8	2008/9	Future
	Score	Days	Days	Days	Years
Sandham Middle	40			3
Solent Middle	35	3
Somerton Middle	40		3
Swanmore Middle	37			3
Ventnor Middle	37	3
West Wight Middle	37			3
High Schools
Carisbrooke High	53			10
Cowes High	45	10
Ryde High	44	10
Sandown High	50		10
Medina High	50		10
Special Schools
Medina House	37			3
St Georges	48	3
Education Other
Nursery Education/Early Years	46	5
School Meals	42		5
Special needs	49			5
AV Unit	40	5
Teachers Pay	44		5
PLASC	48			5
School Bank Accounts Year End Reconciliation	48	5
School Handbook	23		3
Branstone Farm	24			5
School Music Services	26	5
IW County Music Centre	19		5
Children’s Services Resources
Fostering	47			10
Section 17	30			5
Service Centre	29		5
TOTAL		153	176	166

2.4.1 To be a high performing, cost effective council
		2006/7			2007/8	2008/9		Future
FINANCIAL SYSTEMS AUDITS	Score	Days			Days	Days		Years
Main Systems
Housing Benefit	64	60			60	60
Provision For Material Financial Feeder Systems	n/a	160			160	160
Corporate Finance
Pension Investments	38	10
RSG	51				20
Treasury Management	23					10
Insurance and Risk Management	30				10
Capital	42					20
RISK BASED AUDITS
Chief Executives
Overall Management Arrangements	19					10
Human Resource Management	42				10
The Learning Centre	34				10
Legal Services - General	26				10
Local Land Charges	29	10
Electoral Services	32	10
Customer Service Centre/Post Room	54				10
Print Unit	20	10
CORPORATE ISSUES
Agenda 21/ISO 140000	25	10
CORPORATE GOVERNANCE
Governance Framework	53				20
Risk Management System	46					20
Performance Indicators	85	20			20	20
SIC	96	10			10	10
AIM HIGH CONCERNS
Aim High Project Management	72	30
Gershon Savings	71	10			10	10
CPA - LPSA	69	10			10	10
CPA - Coordination/Management	85	20
Decreasing national funding	81				20
Local pressures, budget and process	52				25
Building stock	54					20
Media management	42					20
	Risk		2006/7		2007/8	2008/9		Future
	Score		Days		Days	Days		Years
People Management/change process	88	10
Communication of change	70	10
LSP	58				10
Transparency of decision making	91				20
Accountability for VFM - cabinet	62				20
Central support services VFM	66	20
Corporate objective groups	76				20
Aim High Teams	76				20
Regulatory prioritisation	83	10			10	10
Risk in decision making	78					10
Client side monitoring	66					20
Compliance Audits
Bankline	24	2			2	2
VAT	55					20
Controlled Stationery	21							5
Bank Reconciliation	47	5
Petty Cash	40					10
Banking Arrangements	38				5
Inventories/Assets	48					3
Grants to Outside Bodies	49					5
Births, Deaths & Marriages Registrars	19							5
Members Allowances	42					5
Car Loans/Removal Expenses	16							5
Travelling & Subsistence	38	5
Telephone Services	33				5
Anti - Fraud Audits
Reviewing Policies & Procedures
Gifts and Hospitality	25	1
Codes of Conduct	36	5
Registers of Interest	38				1
Financial Regulations	59				5
Standing Orders as to Contracts	83					5
ICT Security	52				5
Anti-Fraud & Corruption Policy	40	3
Confidential Reporting	38	3
Fraud and Irregularity Procedure	33					3
Fraud awareness training workshops	42				5	5
Pro-Active Fraud Detection Work
Granting of Permissions	68					30
Claims Based Payments	52							30
Contract Awards	66				30
	Risk		2006/7		2007/8	2008/9		Future
	Score		Days		Days	Days		Years
Contract Audits
ONGOING WORK
Final Accounts	41	20			20	20
Contracts Administration		10			10	10
Pre Tender Work	56	5			10	10
Contracts Advice		5			5	5
Current Contracts	56	15			15	15
Financial Evaluations		5			5	5
SPECIFIC PROJECTS
Highways	64	15
Service Contract Monitoring	58	10			10	10
Social Services Care Homes	71	15
Accountable Body Follow-Up	115	5
Partnerships	115	10			15	15
Education Core Contracts	71				15
Leisure Contracting Processes	62					15
Social Services SLAs					10
Education Construction Partners						10
ICT AUDIT PLAN
Define a strategic IT plan		10
Define the information architecture		10
Determine the technology direction		10
Determine the IT organisation and relationships					10
Manage the IT investment					10
Communicate management aims and directions						10
Manage human resources					5
Ensure compliance with external requirements		10			10	10
Assess risk		5			5	5
Manage projects					10
Manage quality		5			5	5
Identify automated solutions						10
Acquire and maintain application software					10
Acquire and maintain technology infrastructure		10			10	10
Develop and maintain procedures					10
	Risk		2006/7	2007/8		2008/9	Future
	Score		Days	Days		Days	Years
Define and manage service levels		10
Manage third party services					10
Manage performance and capacity		10				10
Ensure continuous service		5			5	5
Ensure systems security		10			10	10
Identify and allocate costs					10
Educate and train users						10
Assist and advise customers						10
Manage the configuration		5			5	5
Manage problems and incidents		5			5	5
Manage data		5			5	5
Manage facilities		5			5	5
Manage operations		5			5	5
Project Audits		28				100
Provision for Follow-Up Audits		50			50	50
Contingency		130			130	130
TOTAL		912			1018	1038		65