RAPC 592-26 – Internal Audit Annual Conclusion 2025/26 – Annex 1

Annual Internal Audit Conclusion 2025-26

1. Internal Audit Standards

The Global Internal Audit Standards, issued by the Institute of Internal Auditors and effective in the UK Public Sector from April 2025, guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of the internal audit function. While the Global Internal Audit Standards apply to all internal audit functions, it is acknowledged that internal auditors in the public sector work in a political environment under governance, organisational and funding structures that differ from those of the private sector.

Consequently, internal audit practitioners working in, or for, the UK public sector are required to apply the Global Internal Audit Standards subject to the interpretations and requirements of the Application Note: Global Internal Audit Standards in the UK public sector, issued by Relevant Internal Audit Standard Setters.

In addition, relevant public sector bodies are also required to apply the Chartered Institute of Public Finance & Accountancy (CIPFA) Code of Practice for the Governance of Internal Audit in UK Local Government which provides a conduit for meeting the essential conditions for governance set out in the Global Internal Audit Standards, tailored for UK local government. The collective requirements shall be referred to as the Global Internal Audit Standards in the UK Public Sector.

2. Internal Audit Mandate

The mandate for internal audit in local government is specified within the Accounts and Audit [England] Regulations 2015, which states:

‘5. (1) A relevant authority must undertake an effective internal audit to evaluate the effectiveness of its risk management, control and governance processes, taking into account public sector internal auditing standards or guidance.

(2) Any officer or member of a relevant authority must, if required to do so for the purposes of the internal audit—

(a) make available such documents and records; and

(b) supply such information and explanations

as are considered necessary by those conducting the internal audit.’

The role of internal audit is best summarised through its definition within the Standards as:

‘An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes.’

The Authority is responsible for establishing and maintaining appropriate risk management processes, control systems, accounting records and governance arrangements. Internal audit plays a vital role in advising the Authority that these arrangements are in place and operating effectively.

The Authority’s response to internal audit activity should lead to the strengthening of the control environment and, therefore, contribute to the achievement of the organisations’ objectives.

3. Internal Audit Approach

To enable effective outcomes, internal audit provides a combination of assurance and advisory activities. Assurance work involves objective assessment of how well systems and processes are designed and working, with advisory activities available to help to improve those systems and processes where necessary whilst not assuming any management responsibilities.

As the Chief Internal Auditor, I review the approach to each audit, considering the following key points:

• Level of assurance required.
• Significance of the objectives under review to the organisations’ success.
• Risks inherent in the achievement of objectives.
• Level of confidence required that controls are well designed and operating as intended.

All formal internal audit assignments will result in a published report. The primary purpose of the audit report is to provide an independent and objective opinion to the Authority on the framework of internal control, risk management and governance in operation and to stimulate improvement.

A full range of internal audit services is available in forming the annual audit conclusion:

The Southern Internal Audit Partnership maintain an agile approach to audit, seeking to maximise efficiencies and effectiveness in balancing the time and resource commitments of our partners, with the necessity to provide comprehensive, compliant and value adding assurance.

We have sought to optimise the use of virtual technologies to communicate with key contacts and in completion of our fieldwork, however, the need for site visits to complete elements of testing continues to be assessed and agreed on a case-by-case basis.

4. Internal Audit Coverage

The annual internal audit plan is prepared taking account of the characteristics and relative risks and objectives of the Authority and to support the preparation of the Annual Governance Statement. Work has been planned and performed to establish if sufficient evidence is available to provide reasonable assurance that the framework of governance, risk management and internal control is operating effectively.

The 2025-26 internal audit plan was considered by the Resources, Audit and Performance Committee in March 2025. It was informed by internal audit’s own assessment of risk and materiality in addition to consultation with management to ensure it aligned to organisational objectives / priorities and the key risks facing the organisation.

The plan has remained fluid throughout the year to maintain an effective focus and ensure that it continues to provide assurance, as required, over new or emerging challenges and risks that management need to consider, manage, and mitigate.

Internal audit reviews culminate in an opinion on the assurance that can be placed on the effectiveness of the framework of governance, risk management, and control designed to support the risks to the achievement of management objectives of the service area under review. The assurance opinions are categorised as follows:

5. Resources

The Southern Internal Audit Partnership has a strategy in place to optimise internal audit resource. Ongoing sufficiency of resources (financial, human and technological) are transparently communicated by the chief internal auditor to senior management and the Resources, Audit and Performance Committee through regular reporting as part of the approval of the internal audit plan and further throughout the year as part of the progress reports and ultimately within the annual conclusion.

Any resource implications that put the fulfilment of the internal audit plan and internal audit mandate at risk are reported accordingly through the afore mentioned reports.

There have been no resource implications that have adversely affected the fulfilment of the internal audit mandate or delivery of the Authority’s internal audit plan impacting my ability to provide a conclusion on the organisation’s framework of governance, risk, and internal control.

6. Independence

As your chief internal auditor, I retain no roles or responsibilities that have the potential to impair my independence, either in fact or appearance. Internal auditors engaged in the delivery of the 2025-26 internal audit plan have had no direct operational responsibility or authority over any of the activities reviewed.

I can confirm there has been no interference encountered by the Southern Internal Audit Partnership related to the scope, performance, or communication of internal audit work during the year in the delivery of the internal audit plan or the fulfilment of the internal audit mandate.

7. Impairments

There have been no impairments to internal audit activity during the year. As chief internal auditor I have ensured that the internal audit function has remained free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication.

The internal audit team have maintained an unbiased mental attitude allowing them to perform engagements objectively and enabling them to believe in their work product, with no compromise to quality, and no subordination to their judgment on audit matters, either in fact or appearance.

8. Limitations of Scope

There have been no limitations to the scope of internal audit work during the course of the year.

9. Internal Audit Conclusion

As chief internal auditor, I am responsible for the delivery of an audit conclusion that can be used by the Authority to inform their Annual Governance Statement. The annual audit conclusion culminates in an overall opinion on the adequacy and effectiveness of the organisations’ framework of governance, risk management and control.

In giving this opinion, assurance can never be absolute and therefore, only reasonable assurance can be provided that there are no major weaknesses in the processes reviewed. In assessing the level of assurance to be given, I have based my opinion on:

• written reports on all internal audit work completed during the course of the year (assurance & advisory).
• results of any follow up exercises undertaken in respect of previous years’ internal audit work.
• the results of work of other review bodies where appropriate.
• the extent of resources available to deliver the internal audit work.
• the quality and performance of the internal audit service and the extent of compliance with the Standards
• the proportion of the Authority’s audit need that has been covered within the period.

We enjoy an open and honest working relationship with the Authority. Our planning discussions and risk-based approach to internal audit ensure that the internal audit plan includes areas of significance raised by the Resources, Audit and Performance Committee and senior management to ensure that ongoing organisational improvements can be achieved. I feel that the maturity of this relationship and the Authority’s effective use of internal audit has assisted in identifying and putting in place action to mitigate weaknesses impacting on organisational governance, risk, and control over the 2025-26 financial year.

Annual Internal Audit Conclusion 2025-26

I am satisfied that sufficient assurance and advisory work has been carried out to allow me to form a conclusion on the adequacy and effectiveness of the internal control environment. In my opinion the framework of governance, risk management and control are ‘reasonable’, and audit testing has demonstrated controls to be working in practice.

Where weaknesses have been identified through internal audit review, we have worked with management to agree appropriate corrective actions and a timescale for improvement.

10. Governance, Risk Management & Control – Overview, Key Observations & Themes

Assurance opinions for 2025-26

We are pleased to report that no audits concluded with either a ‘Limited’ or ‘No’ Assurance opinion therefore there are no significant issues to report. Findings from our reviews have been reported to senior management and the Resources, Audit and Performance Committee throughout the year and a summary of the assurance opinions is outlined below.

Corporate Governance Framework - Substantial Assurance

General Ledger, Bank Reconciliations & User Access - Substantial Assurance

Procurement/Contract Management - Reasonable Assurance.

Governance

Governance arrangements are considered during the planning and scoping of each review and in most cases, the scope of our work includes overview of:

• the governance structure in place, including respective roles, responsibilities, and reporting arrangements.
• relevant policies and procedures to ensure that they are in line with requirements, regularly reviewed, approved, and appropriately publicised and accessible to officers and staff.

In addition, during 2025-26 we undertook an assessment of the Authority’s Corporate Governance Framework against the CIPFA Delivering Good Governance in Local Government principles. The review focused on key governance documents and processes, including the Local Code of Governance, Annual Governance Statement, Scheme of Delegation, Standing Orders, and Member Declarations, to confirm they are current, approved, and accessible. The audit concluded in a substantial assurance opinion.

Based on the work completed during the year, in our opinion the governance frameworks in place across the Authority are robust, fit for purpose and subject to regular review. There is also appropriate reporting to the Resources, Audit and Performance Committee to provide the opportunity for independent consideration and challenge including review of the Annual Governance Statement.

Risk management

The risk register is a key document that is considered during the development of our risk based internal audit plan. Additionally, information from the risk register is taken into account when scoping each review in detail to ensure that our work is appropriately aligned.

Control

In general, internal audit work found there to be a sound control environment in place across the majority of review areas included in the 2025-26 plan that were working effectively to support the delivery of corporate objectives. We generally found officers and staff to be aware of the importance of effective control frameworks, and open to our suggestion for improvements or enhancements where needed.

Other Sources of Assurance

Internal audit remained cognisant of other sources of assurance from which the Authority benefit. Due to legal and regularity nature of some public sector assurance providers internal audit do not have engagement with or insight into the scope and timing of their work. Where appropriate internal audit does coordinate with and place reliance on the outcomes of other assurance providers to minimise duplication and highlight potential gaps in assurance needs.

Additionally, as chief internal auditor I liaise with the external auditors on matters of mutual interest and to seek opportunities for cooperation in the conduct of audit work.

During the year there have been no external sources of assurance that have been relied upon when forming my conclusion for 2025-26.

Management actions

Where our work identified risks that we considered fell outside the parameters acceptable to the Authority, we agreed appropriate corrective actions and a timescale for improvement with the responsible managers. Progress is periodically reported during the year to the Resources, Audit and Performance Committee through our quarterly internal audit progress reports.

Acceptance of Risk

From the work carried out by the Southern Internal Audit Partnership during the year, I am not aware of any instances where management have accepted a level of risk that we feel exceeds the organisations risk appetite or risk tolerance.

11. Themes

The findings and conclusions of multiple engagements, when viewed holistically, can reveal patterns or trends, such as root causes. Analysis of root cause through assurance work undertaken across the organisation’s framework of governance, risk management and control processes during the year has highlighted common themes where either standards & policies or operational processes & procedures* could benefit from further formalisation in order to strengthen consistency, provide greater resilience if key officers are absent, or provide clearer visibility over on-going activity to ensure requirements are met.

*Definitions to support root cause categorisations are detailed in Annexe 2.

12. Anti-Fraud and anti-corruption

In accordance with the internal audit charter and the audit plan, auditors will plan and evaluate their work so as to have a reasonable expectation of detecting fraud and identifying any significant weaknesses in internal controls.

Whilst not responsible for the detection of fraud within the Authority, Southern Internal Audit Partnerships work during 2025/26 has not identified, and we have not been made aware of, any significant control deficiencies that may pose a significant fraud risk.

13. Quality Assurance and Improvement

From 1 April 2025, the ‘standards or guidance’ in relation to internal audit are those laid down in the Global Internal Audit Standards, Application Note: Global Internal Audit Standards in the UK Public Sector and the Code of Practice for the Governance of Internal Audit in UK Local Government. The collective requirements shall be referred to as the Global Internal Audit Standards in the UK Public Sector.

Standard 8.4 [External Quality Assessment] requires internal audit providers to undergo an external quality assessment every five years. In September 2025 JC Training Ltd were commissioned to complete an external quality assessment of the Southern Internal Audit Partnership against the Global Internal Audit Standards in the UK Public Sector.

In considering all sources of evidence the external assessor concluded:

‘SIAP has achieved an excellent result of ‘generally achieves’ in this EQA in relation to the GIAS and Application Note. The IIA use the term ‘general achievement’ or ‘general conformance’ to indicate that “internal audit activities were performed in general conformance with the Global Standards.”

I include a summary of SIAP’s conformance to the GIAS, below. Overall, I believe that the team has achieved an excellent performance given its size, together with the breadth and depth of the benchmark established by the new GIAS.

I am delighted to confirm that SIAP fully achieves 46 of the 52 Standards and generally achieves the remaining six Standards. There are no partial conformances, or areas where the team do not conform with any Standards.

I have undertaken ten reviews of diverse internal audit functions using the (new) GIAS to date and this result puts SIAP firmly within the top quartile and represents the highest level of achievement and conformance with the new GIAS that I have seen to date.’

14. Disclosure of Non-Conformance

There are no disclosures of Non-Conformance to report. In accordance with Global Internal Audit Standards in the UK Public Sector, I can confirm through endorsement from the independent external quality assessment that:

‘The Southern Internal Audit Partnership ‘generally conforms’ to the Global Internal Audit Standards in the UK Public Sector and its work is performed in accordance with the International Professional Practices Framework (endorsed by the IIA).’

15. Quality Control

Our aim is to provide a service that remains responsive to the needs of the Authority and maintains consistently high standards. In complementing the QAIP this was achieved in 2025-26 through the following internal processes:

• On-going liaison with management to ascertain risk management, control and governance arrangements, key to corporate success
• On-going constructive working relationships with other assurance providers to maintain a cooperative assurance approach.
• A tailored audit approach using a defined methodology and assignment control documentation.
• Review and quality control of all internal audit work by professional qualified senior staff members.
• An external quality assessment against the industry Standards.
• Maintenance of Key Performance Indicators and ongoing overview of Internal Audit Strategy and Partnership objectives / actions (Annexe 1)

16. Acknowledgement

I would like to take this opportunity to thank all those staff throughout the Authority with whom we have made contact in the year. Our relationship has been positive, and management were responsive to the comments we made both informally and through our formal reporting.

Antony Harvey

Deputy Head of Southern Internal Audit Partnership

Annexe 1

Performance Measurement

Key Performance Indicators

Internal Audit Strategy 2025/28

EQA / QAIP Action Plan

Root Cause Categories Annexe 2