External Quality Assessment - Global Internal Audit Standards - Scottish Government Internal Audit

Description

As required under the Global Internal Audit Standards (GIAS), Scottish Government Internal Audit (SG IA) is required to have a quality assurance and improvement programme which includes both internal and external assessments. The external assessment must be completed once every five years by a qualified, independent assessor or assessment team from outside the organisation. The external assessment may be accomplished through a full external assessment or self-assessment with independent external validation. The reports from the External Quality Assessment (EQA) will support SG IA to make improvements in its ways of working. The headlines and summary findings from the report will be shared with key stakeholders, including the Audit Committees of the SG core and the 24 public body clients. Full copies of the report may be provided to key stakeholders at the discretion of the SG IA. Lot 1: The Internal Audit function to be reviewed as part of this External Quality Assessment (EQA) comprises: 1) 34 Internal Auditors – 26 providing services to SG core 2) 24 public bodies, and 8 delivering Audit Authority services in relation to the European Structural and Investment funds. 3) Clients – SG core and 24 public bodies comprising agencies, Non-Departmental Public Bodes and Non-Ministerial Offices. 4) Deliver approximately 3000 days of audit work and approximately 110 assurance and advisory assignments per annum. 5) Stakeholder engagement and provision of Head of Internal Audit function for SG core and 24 public bodies, including attendance at client Audit and Risk Committees (or equivalent). 6) The Directorate has a co-source partnership with EY. The existing contract ends in August 2024 and new contract commences in September 2024. The contract is used to provide capacity for internal audit services, support IA to develop its capability and deliver elements of Audit Authority systems audit work regarding European Structural and Investment Funds. 7) IA works on a hybrid basis with onsite locations in Edinburgh and Glasgow. 8) The function is headed by the Director of Internal Audit and Assurance, supported by a Deputy Director. The Director acts as the Head of Internal Audit (Chief Audit Executive) for SG core and the Head of Internal Audit responsibility is delegated to Senior Internal Audit Managers for public body clients. 9) The Directorate sits functionally in Director-General Scottish Exchequer and has a direct reporting line to the Permanent Secretary of the Scottish Government as Principal Accountable Officer for the Scottish Government. 10) The owner of the final reports from the EQA will be the Director of Internal Audit and Assurance. The timelines as outlined later in this specification need to be met to ensure the EQA is completed timeously. The provider is required to perform a review of the internal audit service in accordance with the Internal Audit Quality Assessment Framework (IAQAF). It is envisaged that this would be carried out by: 1) interviews with key internal audit stakeholders; 2) meetings with the Chief Audit Executive (Director of Internal Audit and Assurance) and members of the internal audit team as required; 3) an electronic questionnaire to be sent to a wide range of 'customers' (as set out in the IAQAF) 4) a review of key documentation to understand the current processes to include audit plan, Charter, Audit Committee reports, internal audit reports and a sample of working paper files; 5) evaluation of the internal audit function against the IAQAF including consideration of best practice and the Institute of Internal Audit Standards and code of ethics as appropriate; 6) presentation of key findings and recommendations to (recipient to be defined); 7) a completed written IAQAF assessment including recommendations.