The Chief Internal Auditor introduced the Draft Internal Audit Operational Plan Following presentation of the report, questions and comments were invited:

A Member asked for further information on the audit cycle, and asked how often a secondary school expected to be audited.  The Chief Internal Auditor explained that there would normally be just one secondary school and several primary schools on the audit cycle each year and a secondary school should expect to be audited every 5-6 years depending on the risk profile.  Primary schools should expect to be audited every 5 years. Currently staffing resources are limited so these periods are extended to 8 years.  If a particular issue is identified, audits can be brought forward or unannounced visits conducted.  Other areas are audited every 5 years according to an annual risk assessment.

It was questioned how the Committee can judge the adequacy of the  Audit Plan.  The Deputy Chief Executive explained that there is a more detailed working document shared with the SLT to facilitate discussion between Chief Officers and the Chief Internal Auditor whereby emerging risks are flagged and capacity determined. Officers will reflect on how best to improve assurance for Committee Members.  Assurance was provided of good coverage across the organisation.

It was clarified that Enterprise doesn’t include Landlord Services; the industrial units and leisure park are a component part of Resources.

A Member asked how performance is measured mentioning that of the 975 available days, there are 658 audit days.  The Chief Internal Auditor clarified that quarterly reports  are provided to include progress against the plan, work undertaken, audit opinions issued against the plan. There is also performance assessment based on performance indicators such as progress against plan, timeliness of issue of draft and final reports, turnover in team, response to special investigations etc.

The value added by Internal Audit was queried in terms of what control and value for money improvements have been made as a result of internal audit recommendations.  The Chief Internal Auditor will report back in due course.

In response to a question, it was explained that Torfaen County Borough Council Internal Audit Team is responsible for the audit of SRS Data Centre.  The outcomes are reported annually and included in the Chief Internal Auditor’s Annual Report for third party assurance.  It was queried what other collaboration risks are outside the organisation and how assurance is obtained.  It was explained that the MCC Audit Team audits all the authority’s systems. It is not involved in the audit of other collaborations.  It was agreed that a list of the key collaborations and arrangements for audit would be brought back to a future Governance and Audit Committee meeting.

As per the recommendations, the Governance and Audit Committee reviewed, commented on and approved the Draft Internal Audit Plan 2022/23 on the understanding that any material changes would be brought back before Committee for information or approval.