Internal audit

The Board has a team of internal auditors. This pages gives a brief overview of the objectives, responsibilities and methods of operation of the Board’s internal audit function.

What is the role of an internal auditor?

Internal auditors are "business generalists" who specialise in efficiency and effectiveness for the good of the organisation and its stakeholders. Their roles include monitoring, assessing, and analysing organisational risks and controls; and reviewing and confirming information and compliance with policies, procedures, and laws. Working in partnership with management, internal auditors provide the Board (through the Audit Committee) and the Executive Team with assurance that risks are held at bay and that the organisation’s corporate governance is strong and effective. If there is room for improvement anywhere within the organisation, the internal auditors will make recommendations for enhancing processes, policies, and procedures.

What is an audit?

An audit is an opportunity for a Board department to stop and take a look at what it is doing. Meeting day-to-day objectives, managers usually have little time to evaluate how well their processes are controlled. A formal audit provides extra, impartial resources to review the adequacy and cost effectiveness of controls over operations. We are interested in getting things done properly, not in blaming individuals for mistakes.

How does an audit work?

Audits are planned out over three years to ensure that every part of the business is covered. When it is time for a department or activity to be audited, an auditor will contact the manager in charge to find out more about the area. This will include facts and figures, targets and objectives but also any new developments and ideas for improvement. About a week before the audit fieldwork starts, we issue a formal Audit Remit document which sets out the scope and objectives of the audit exercise. This reflects both the concerns of the local management and wider issues of interest to the Chief Executive and the Audit Committee. Audit fieldwork consists of gathering evidence (observing, talking to people, checking paperwork or computer records) to show whether and how well the controls are operating. Findings are recorded in an audit report which is discussed at length in its draft form until action by those responsible is agreed. Then the report is finalised and sent to all the directors. This isn’t quite the end. Periodically, we check on the progress being made on the agreed actions and report on this to the Executive Team.

Reviewing internal audit

Internal Audit's own adequacy and effectiveness is regularly reviewed to ensure it meets the requirements of approved standards. Each year, Audit Scotland - the Board’s external auditor - conducts a review of the adequacy of Internal Audit as part of their audit planning activity, to determine the level of reliance they can place on the Board’s internal audit work. Additionally, every three years, Internal Audit is subject to an external “Quality Assurance Review” against recognised governmental standards for internal audit.

You can read more about our System of Internal Control and Audit Scotland's opinion of our internal audit function in our Annual Report 2003/2004.