WIXLIB

CIIAStandardQAIP Ref.& EvidenceA training budget is determined from the PDR and the programmeof work, which is included within the funding requirement put tothe Audit & Risk Committee in June each year.17. IA appetite forinnovation and newworking practices toenhance serviceprovisionIA StrategyThe HIA actively keeps abreast of current developments in the auditprofession and considers application to service delivery.12301300The HIA regularly maintains contact with other HIAs both in the HEsector via CHEIA and outside the sector via CIIA events, and theWales HIA networking group. CIIA HIA forum membership andattendance at events at national level.Working practices and templates are considered at regular pointsincluding at team audit planning sessions and in advance of the newacademic year.Appetite to incorporate data analytics into assignments where datamaturity allows.18 & 20. Internal &External Assessmentsof IAInternal review is completed for all work undertaken as part of dayto-day supervision prior to report release, as noted on the PAD andall published reports.Quality Assessmentand ImprovementProgramme (QAIP)IA completes the CHEIA peer review self-assessment annually andmaintains a ‘Quality Assurance and Improvement Programme’(QAIP). Annually the Audit & Risk Committee receive the QAIPaction plan, results and next steps (typically October) and this isincluded in the Annual Report.130013101311132013211322200022402430Formal external review is planned for 2021/22, to be determined bythe Audit & Risk Committee, paper presented outlining HEFCWFinancial Management Code requirements in October 2021.19. Auditees opinionof quality of servicereceived2431Feedback is gathered via several informal mechanisms, collated andreported annually to the Audit & Risk Committee (at their request)and included within the Annual Report.1311The HEFCW Financial Management Code details requirements forthe appointment, removal, or resignation of internal and externalauditors, where governing bodies are responsible for theappointment and removal of both internal and external auditors.1110Annual Report21. Appointment,removal & resignationof auditorsHEFCW FinancialManagement CodeOrdinancesAudit & Risk Committee advise on the appointment and terminationof the Head of Internal Audit.Ordinances of the Audit & Risk Committee outline theirresponsibility to advise the governing body on the appointment ofaudit providers.23 & 33. Developmentand progress of a riskbased Audit Strategyand PlanUEB Risk RegisterAudit UniverseIA Strategy & PlanProgress ReportRisk Assurance MapThe University Executive Board’s (UEB) Risk Register forms thestarting point for the Audit Strategy and Plan. The risk register islaid over the Audit Universe and there is direct line of sight from thehigher-level risks through to the Audit Programme for the year.111120102060Extensive consultation is undertaken during the planning processwith management and governors.Risk assurance mapping processes are considered as they becomeembedded into the institution.5 P a g e

CIIAStandardQAIP Ref.& EvidenceThe programme is reviewed quarterly by UEB and the Audit & RiskCommittee, and changes proposed are documented. KPIs areincluded within the progress report and notes any limitations.A level of contingency days are built into the plan to enable theservice to respond to emerging risks.24. Knowledgetransfer available tosupport the IAfunctionThe IA function is supported by two co-sourced partners to addressany gaps in the plan.1210IA is on the distribution list for UEB, committees of Council andother sub-committees as required. Regular diarised meetingsbetween HIA and the Chief Operating Officer, University Secretary,Director of Financial Operations and Chair of Council2010Contracts for cosourced provision25. Processes toensure IA are keptinformed ofinstitutional changesimpacting the riskenvironmentUEB, Council,committees of Council& sub-committeepapers26. Audit Universecoverage of theinstitution andassociated activitiesAudit CharterAudit Universe27. IA resourceadaptable to changingrisk profileIA StrategyAnnual planning meetings are held between the HIA and the ViceChancellor and Pro Vice-Chancellors as a minimum.IA Charter specifically refers to 'Cardiff University and its affiliates'in section 6.1000201021002201The audit universe incorporates associated activities of theuniversity, including the Student Union, joint ventures andsubsidiary companies, and continues to be extended.The ‘IA Strategy, Plan and Budget’ is presented to Audit & RiskCommittee for review, endorsement and recommendation toCouncil, including that 'the resources are sufficient bearing in mindthe University's risk profile’; and, proposed areas of coverage etc.1110201020302230Any additional requirements would be taken to Audit & RiskCommittee for consideration when required.28. Communication ofthe approved IAStrategyThe IA Strategy and Plan is received by University Executive Board,Audit & Risk Committee, and Council.2020IA audit coverage determined in the strategy and amendmentsapproved by Audit & Risk Committee.20202030A high-level risk assurance map has been completed to aid oversightof other assurance providers across the institution. Any externalsources of assurance available are considered for each auditassignment via the RIPE.2050IA Strategy29. No limitations toscope of IA coverageIA Strategy32. IA overview ofother assuranceprovidersAnnual ReportRIPETime is built into the Audit Plan to accomplish an overview of otherassurance providers and liaise with such providers, includingdiscussions with external auditors, Wellcome and UKRI.6 P a g e

CIIAStandardQAIP Ref.& EvidenceThe co-ordination and alignment of external assurance sources isbeing led by IA at present. There is an increasing maturity ofinstitutional assurance frameworks.Known assurance providers to IA include: UKRI funding assurancereview, HTA external visit, HEPCW VfM report, C. G. Lees researchfunding assurance and the work of the KPMG data returns(commissioned by HEFCW).34. Annual Report toAudit & RiskCommittee for periodunder reviewHEFCW FinancialManagement CodeAnnual Report35 & 59. Audit & RiskCommittee monitoreffectiveness andperformance of IAQuarterly progressreportQAIPCUC Audit CommitteeCode of Practice36. Mechanisms topromote adherence toethical standardsIA CharterRIPEAnnual Report presented to Audit & Risk Committee in Octobereach year. In advance of this, the Annual Report is presented toUniversity Executive Board for discussion and comment.In accordance with the HEFCW Financial Management Code theAnnual Report provides an opinion of governance, riskmanagement, internal controls, data quality and value for money,regards adequacy and effectiveness.1000111113002060Quarterly progress report to each Audit & Risk Committee, whichincludes operational KPIs for monitoring purposes.11002060Regular in camera meetings with the Audit & Risk Committee andthe Chair in line with scheduled committee meetings.2070IA self-assessment completed annually.The Chair of Audit & Risk Committee provides input to the HIAPDR, which feeds into HIA pay review.The CUC Audit Committee Code of Practice (May 2020), refers tocommittee oversight of internal audit effectiveness, specifically‘Element 8: The Audit Committee exercises effective oversight ofinternal audit’.Processes to direct adherence to ethical standards are embeddedwithin the audit methodology including: the IA Charter (Section 2),independence & objectivity considerations for each assignment viathe RIPE, and the requirement for all in-house staff to be qualifiedwhich require annual declarations to be made of conformance toethical standards of relevant bodies.110011201210122013001311132220002040243137. IA consideration ofinstitutionalgovernanceIA CharterIA StrategyIA Annual ReportIncluded within the IA Charter, Strategy and opinion within theAnnual Report.Annual governance audit carried out to meet HEFCW FMCrequirements for opinion. The annual report draws togetheremerging governance themes in the root cause analysis of emergingthemes.1000210021102201Council effectiveness review conducted periodically. Last reviewcompleted in 2020/21 which is included in the opinion.38. IA consideration ofrisk managementIncluded within the IA Charter, Strategy and Opinion within theAnnual Report.100021007 P a g e

CIIAStandardQAIP Ref.& EvidenceIA CharterIA StrategyIA Annual ReportAnnual risk management audit carried out to meet HEFCW FMCrequirements for opinion. The annual report draws togetheremerging risk management themes.2120220139. IA consideration ofinternal controlsIncluded within the IA Charter, Strategy and Opinion within theAnnual Report.IA CharterIA StrategyIA Annual ReportEvery audit considers the internal control environment which feedsinto the annual opinion. The annual report draws together emergingthemes via a root cause analysis.10002100213040. IA consideration ofvalue for moneyIncluded within the IA Charter, Strategy and Opinion within theAnnual Report.IA CharterIA StrategyIA Annual ReportPriority ratings ofrecommendationsEvery audit considers value for money arrangements which feedsinto the annual opinion. The annual report draws togetheremerging themes via a root cause analysis.22011000210021302201The internal audit methodology includes the ability to raise VfMpoints within each audit, as well as looking to audit specific areaswith a VfM slant.Management assurances and external forms of assurances areconsidered in deriving theVfM opinion.41. Documented workprogrammes toachieve engagementobjectivesRIPEPADTerms of Reference(ToR)43. Planning ofindividual auditassignmentsRIPEPADToRAt the planning stage of each audit the methodology requires thecompletion of a RIPE and PAD (Process Analysis and Design) form.Both are the foundation for the completion of the Terms of Referencewhich outlines risks, objectives covered and requirements of testingincluding the tools and techniques used. Each piece of work isbespoke. The same methodology is applied for consultancy/adviceengagements.22002210Initial conversations are held with members of UEB when the HIAholds annual planning meetings. The HIA assigns an auditor whocompletes desk-based research to commence the completion of thePAD and RIPE.220022102230224022202230Planning meetings with key contacts are arranged to discuss theaudit area and associated risks to facilitate the completion of theRIPE and PAD, and ultimately a Terms of Reference.Each audit is assigned a UEB Sponsor, determined by the riskregister in most instances. Once the RIPE and draft ToR have beenreviewed by HIA (or reviewer), a draft of the ToR will be sharedwith the UEB sponsor for agreement, which includes; scope(including any limitations where relevant), objectives, risks,deliverables and proposed timelines.The audit will only commence once a final ToR has been releasedfollowing agreement of the draft.44, 47, 48 & 50.Reports provide fulland completedisclosure of materialfacts.Recommendations areThe PAD/RIPE are the key documents to connect the audit fromplanning through to the report. The summary of the PAD informsthe overall conclusion of the audit. Audit close meetings are held forall assignments including advisory work. Format of close meetingsdiffers depending on the assignment, PowerPoint presentation usedfor large assignments to relay findings through the discussion.131123002310232023308 P a g e

CIIAStandardQAIP Ref.& Evidenceidentifiable from thePAD to IA reportPADRIPEReport TemplatesShared drivesAssurance ratingsHIA/alternate undertakes review of all working papers and evidenceof this review is presented on the PAD. Paper files are not created,all information is held on the shared drive within the relevant auditassignment folder.Report templates are in place for assurance / advisory assignments,to be tailored as required and must demonstrate the link to auditrisks from the ToR and PAD. Standard wording for conclusionsagreed by Audit & Risk Committee and applied to all assignmentswithin these templates.23402400241024212440A separate follow-up template is in place. The style of reporting isextended to the external contractors, who badge their own reportsbut utilise our methodology and style.KPI’s are used to monitor performance of the reporting processwhich are monitored by Audit & Risk Committee.45 & 51. Supervisionof audit engagementsand quality assuranceRIPEPADReport TemplateQAIPAudit review is captured for all assignments electronically, filereview is evidenced on the RIPE, PAD and draft report, prior torelease. In the instance where the HIA undertakes audit work, areview is undertaken by another member of staff.1300131123402420External sub-contracted auditors follow their agreed in-house QAprotocols.2430Team meetings provide opportunity to discuss lessons learned fromeach assignment, to continuously improve working practices.QAIP conducted annually by HIA as a peer-reviewed selfassessment.46. Appropriatecontrol over access toengagement recordsManagement andprotection of data:mandatory actions forinternal auditorsShared drive – filestructureAudit assignment engagement records are held on the shared drive.There is restricted access to the shared drive with only IA teammembers having access. An IA TEAMS site is available for use alsofor convenience and accessible to IA staff only. The shared driveremains the definitive and authoritative information source.20402330IA only release audit ToR’s and reports to the UEB Sponsor andLead Contact, unless advised to circulate further or where requiredfor completion of management response, e.g. a recommendationrequires action from more than one department/school.Further details are provided in the ‘Management and Protection ofData’, which is mandatory for all IA staff.IA document retention and data policy maintained by IA, lastupdated April 2021.All university staff are required to annually complete mandatory‘Information Security’ e-learning.49, 56 & 57.Managementagreement ofrecommendations andprocedures for dealingwith disagreementsReport templatesAudit & RiskCommittee ToRThe reporting requirements are set out in the ToR for each piece ofwork undertaken. Management have 10 working days to provide amanagement response to the draft report, which requires a responseto each recommendation (unless advisory), confirming if they agreeor disagree with recommendations. On return, IA check forreasonableness of responses and timeliness of completion, prior toissuing as a final report. On receipt of the management responses IAwill aim to issue the final report within 5 working days.11112400241026009 P a g e

CIIAStandardQAIP Ref.& EvidenceIA CharterIn instances where recommendations are not accepted, Audit & RiskCommittee will be made aware of the discrepancy, and thatmanagement choose to accept the risk by not implementing therecommendation.Section 3 of the IA Charter refers, if there is interference withreporting or communication of risks and section 6, “the HIA willreport periodically to senior management and the Audit & RiskCommittee any response to risk by management that may beunacceptable to Cardiff University.” This is undertaken routinelyvia the Tracker.52. Exclusion ofrecommendation fromthe reportPADReviewed draft report53. Audit opinionsAssurance ratingsThis is not common practice but may happen if recommendationsare grouped into an action category. All decisions are clearlydocumented on the PAD and reviewed audit report, providingdirect line of sight from the RIPE and PAD, to the final report.233024202440Assurance ratings are documented and appended to every report,which were approved by the Audit & Risk Committee, 'Review ofInternal Audit Assurance Ratings for 2017/18 - 17/34’ to aligndirectly with the risk management framework.2040221024102450The HIA reviews all internally and externally produced work forconsistency with this framework.54. Follow-up of prioryear / in year IArecommendationsTrackerFUP reportUEB and thereafter the Audit & Risk Committee (at each meeting)receives a report of the highly rated recommendations, ‘the Tracker’.The Tracker lists all Priority-1 recommendations, highlighting thoseoutstanding and an IA assessment of the risk remaining to thebusiness if recommendations are not implemented. The number ofitems on the tracker also contributes to the IA Opinion.25002600The Tracker paper captures the progress of undertaking follow-upsof each audit assignment, where all categories of recommendationare followed up on and released as a separate report.55. Mechanisms inplace to timetable thecompletion of auditwork and deliverablesIA StrategyToR58. Benchmarking ofIA costsThe IA Strategy and Programme outlines the timetable forcompletion of audit work. Regular updates are made to the Auditand Risk Committee as a standing item through the progress report,and amendments to the plan clearly shown and formally requestedfrom the committee.20002200Each audit assignment terms of reference details proposed timelinesand deliverables.Benchmarking of IA costs is included within Audit Strategy andPlan annually using the annual BUFDG survey output.1110The Audit & Risk Committee receive the results of the QAIP forreview and discussion, minutes of the meeting record thecommittee’s response regarding performance.13112230IA Strategy60. Audit & RiskCommittee’sassessment of theperformance of IAQAIPAudit & Risk Committee self-evaluation would also provide insightto performance of IA.Audit & Risk Committee Chair Annual Report to Council states “thecommittee has satisfied itself that reliance can be placed on the10 P a g e

CIIAStandardQAIP Ref.& EvidenceAudit & RiskCommittee selfevaluationAudit & RiskCommittee AnnualReportreporting made by the Internal Audit function in place during theyear”11 P a g e

Key Documents and Evidence1.3Cardiff University Website – Internal /corporate-information/internal-audit2.Cardiff University Intranet – Internal Audit f University Website – Audit & Risk Committee Terms of 343-ordinances4.Audit & Risk Committee approval:Internal Audit Charter (October 2020 Meeting Book)5.Internal Audit Strategy and Plan (Approved annually in October Meeting Book)6.Internal Audit Annual Report (Approved annually in November Meeting Book)7.Progress Reports (Presented at each Audit &

The Manual establishes the key operating policies and procedures that govern the internal audit(IA)activity with a further view to strengthening professionalism of the function and serving as a guidance document to staff at Cardiff University on the 'modus operandi' of the service.