Chapter 3 – Policy Implications for Gaelic - University of Edinburgh

Appendix 1
Internal Audit Plan 2012-2013
Introduction
1 Internal Audit provide a service to the whole of the University of Edinburgh, primarily by
providing independent assessments of controls in specific areas, and ensuring that,
overall, risks are managed properly. In this way, Internal Audit plays a vital part in
governance arrangements, so that internal and external stakeholders (including the
University Court and the Principal) can have confidence in the agreed policies and
procedures and gain an understanding of how well they have been implemented.
Moreover, they will also have confidence that the University is responding appropriately
to new challenges, for example provided by new funding arrangements, the integration of
new institutions into the University or concerns raised by measures to comply with new
legislation. Where potential improvements are identified, timetables are agreed with
management to take action as appropriate. This service is particularly important in such a
complex and diverse organisation as the University of Edinburgh.
2 The University’s Internal Audit Service has been provided by an “in-house” team since
1999 and has been providing further audit services to external “clients” since 2003. Such
contracts are important as they help validate the quality of our service and provide
income to fund the employment of outside specialist contract resources to augment the
internal audit personnel. This achieves an overall richer skill mix. As a Service, we work
hard to maintain a professional, high quality Internal Audit service, and to ensure that we
are accessible and responsive. We request feedback from management after every review
and this feedback is monitored and reported on each year. The Service achieved
Investors in People (IIP) accreditation in 2010.
3 The purpose of this paper is to outline the detailed Internal Audit Plan for the next
financial year and to provide an overview of our methodology.
Overview of Internal Audit Approach
4 The approach to Internal Audit planning adopted by the University of Edinburgh Internal
Audit Service is fully consistent with best practice (notably Scottish Funding Council
(SFC) advice, Higher Education Funding Council for England (HEFCE) guidance, and
the approach to Risk Based Internal Auditing (RBIA) recommended by the Institute of
Internal Auditors (IIA)). To comply with recognised professional internal auditing
standards, we also invited (for 3 out of the last 5 academic years) external peer review
quality assurance assessments of our service, which concluded that our audit planning
operates in accordance with best practice. The Internal Audit planning process also takes
account of the guidance in the Committee of University Chairmen Handbook for
Members of Audit Committees in Higher Education Institutions endorsed by SFC in
2008.
5 The SFC’s Financial Memorandum requires that the Internal Audit service must extend
its review over all the financial and other management control systems identified by the
audit needs assessment process. It must cover all activities in which the University has a
financial interest, including those not funded by the Council. In accordance with the
Terms of Reference approved by Court in November 2010, the Audit Committee shall
receive and make recommendations to the Court in respect of the Internal Audit Plan.
6 HEFCE commissioned guidance to assist institutions in applying the professional IIA
Standards in a Higher Education environment. It is not intended to be prescriptive but to
outline a generic application of a risk-based audit methodology. The term ‘risk-based’
Page 1 of 22