Review Of The Audit And Risk Committee Charter & Review Of The Internal Audit Policy · Attachment 2_Internal Audit Policy_Draft

Page 2

INTERNAL AUDIT POLICY




      Provide assurance to the Chief Executive Officer and the Audit and Risk Committee
       that the Council’s financial and operating controls designed to manage risks and
       achieve corporate objectives are operating in an efficient, effective, economical, and
       ethical manner.
      Assist management in improving our business performance and ensuring Council’s
       operations comply with Council policies and procedures.

The scope of internal audit shall be sufficiently comprehensive to ensure the effective and
regular review of key activities which may extend to all areas of council including but not be
limited to the following key areas:

      Audit of Council’s activities, processes, control frameworks, compliance obligations
       and to recommend any business process improvement requirements.
      Advisory services to offer professional objective and independent advice to Council on
       a range of matters including for new services, systems and processes and risk
       management.
      Detecting and reporting irregularities so that Council can take action and report such
       irregularities in accordance with legislative requirements.
      Risk assessment and management, including the identification and assessment of
       risks – current and emerging - to which Council’s operations are exposed.

A risk based Annual Internal Audit Plan which outlines the scope, objectives, and schedule of
audit activities to be undertaken will be developed and reviewed by the Audit and Risk
Committee before being recommend for Council’s endorsement. The Annual Audit Plan
ensures effective utilisation of audit resources and appropriate coverage of Council systems
and operations.

An effective internal audit function will seek to achieve the following outcomes:

   a) Assess and evaluate Council’s processes, procedures and internal control
      environment to assist with the management of strategic and operational risks.
   b) Appraise the relevance, reliability and integrity of management, business systems,
      financial and operating records and reports.
   c) Assist the Chief Executive Officer (CEO) and Council in the effective discharge of their
      responsibilities by providing them with analyses, appraisals, reports, recommendations
      and information concerning the activities reviewed.
   d) Provide advisory services to offer professional objective and independent advice to
      Council on a range of matters including for new services, systems and processes and
      risk management.
   e) Undertake risk assessments and risk management, including the identification and
      assessment of risks to which Council’s operations are exposed.
   f) Assess compliance with Council policies and procedures, legislative compliance and
      reporting processes, and best practice.
   g) Detect any reporting irregularities so that Council can act and report such irregularities
      in accordance with legislative requirements, and
   h) Provide outcomes that will generally improve practices across Council.
   i) Examine and evaluate operational functions to maximise the economic, efficient, and
      effective use of all council resources in the achievement of council’s priorities and
      objectives.



                                                                                        Page 2

Page 3

INTERNAL AUDIT POLICY



 4. INTERNAL AUDIT’S STANDING WITHIN COUNCIL

The responsibility to establish an efficient and effective internal audit function has been
delegated by Council to the Chief Executive Officer with oversight by the Audit and Risk
Committee.

The internal audit function must be independent reporting directly to the Chief Executive
Officer and objective in undertaking audit activities. The Internal Auditor must declare and
disclose any Conflict of Interest to Council, including any potential conflict of interest.

The internal audit function may be delivered in house or outsourced subject to a review of
Council’s operational requirements and an evaluation of the most effective and cost-efficient
model.

A professional relationship will be maintained with Council’s External Auditors. A close liaison
will result in a cost-effective use of audit resources ensuring the best value to Council.


 5. STANDARDS

The Internal Audit function will be conducted in accordance with relevant professional
standards including:
     Standards for the Professional Practice of Internal Auditing including the Global
       Internal Audit Standards effective on 09/01/25 and Standards for the Professional
       Practice of Internal Auditing issued by the Institute of Internal Auditors including the IIA
       Code of Ethics.
     Standards relevant to internal audit issued by CPA Australia (CPA) and Chartered
       Accountants Australia and New Zealand (CA ANZ).
     The Statement on Information Systems Auditing Standards issued by the ISACA.
     Standards issued by Standards Australia and the International Standards Organisation
       including the Australian and New Zealand Standard on Risk Management AS ISO
       31000:2018.


 6. INTERNAL AUDIT RESOURCES

The annual budget for the provision of internal audit services is approved by Council with the
adoption of the Noosa Shire Council Annual Budget. The Chief Executive Officer may approve
additional audit resources on the advice of the Audit and Risk Committee. Approval will be
undertaken in accordance with Council policies.


 7. SCOPE

This Policy applies to:

      All Council activities, including entities over which Council has direct ownership,
       management, or financial control; and
      All Council officers, councillors, contractors, the officers, and Committee members of
       related entities involved in and with responsibility for contributing towards the
       achievement of Council’s objectives.


                                                                                           Page 3

Page 4

INTERNAL AUDIT POLICY



 8. REVIEW

 The Internal Audit Policy will be reviewed by the Audit and Risk Committee and endorsed
 by Council annually or as required from time to time.



 9. RELEVANT LEGISLATION AND POLICIES


        Local Government Act 2009
         S 105 (1) Each local government must establish an efficient and effective internal audit
         function
        Local Government Regulation 2012
         S 207 (1) Internal audit
         (1) For each financial year, a local government must—
         (a) prepare an internal audit plan; and
         (b) carry out an internal audit; and
         (c) prepare a progress report for the internal audit; and
         (d) assess compliance with the internal audit plan.

         S207 (2) A local government’s internal audit plan is a document that includes statements
         about—
         (a) the way in which the operational risks have been evaluated; and
         (b) the most significant operational risks identified from the evaluation; and
         (c) the control measures that the local government has adopted, or is to adopt, to manage
         the most significant operational risks.

        Audit and Risk Committee Charter
        Enterprise Risk and Opportunity Management Policy


 10. DEFINITIONS
 Audit and Risk Committee is an advisory Committee of Council established in accordance
 with section 105(2) of the Local Government Act 2009 charged with monitoring assurance,
 oversight, and advice to Council in relation to making recommendations about matters that
 the Committee considers need action or improvement especially in relation to the Internal
 Audit Plan and monitoring the progress of management actions.
 Code of Ethics means The Code of Ethics of the Institute of Internal Auditors and are the
 principles relevant to the profession and practice of internal auditing and the rules of conduct
 that describe the behaviour expected on internal auditors. The Code of Ethics applies to all
 parties and entities that provide internal audit services and functions. The purpose of the
 Code of Ethics is to promote and ethical culture in the global profession of internal auditing.
 Conflict of Interest means any relationship, that is, or appears to be, not in the best interests
 of the organisation. A conflict of interest would prejudice an individual’s ability to perform his
 or her duties and responsibilities objectively.
 Core Principles for the Professional Practice of Internal Auditing means the internal
 audit function:

        Demonstrates integrity.
        Demonstrates competence and due professional care.

                                                                                              Page 4

Page 5

INTERNAL AUDIT POLICY




          Is objective and free from undue influence.
          Aligns with the strategies, objectives and risks of the organisation.
          Is appropriately positioned and adequately resourced.
          Demonstrates quality and continuous improvement.
          Communicates effectively.
          Provides risk-based assurance.
          Is insightful, proactive, and future-focused.
          Promotes organisational improvement.
 Council Delegation: Section 105(1) of the Local Government Act 2009 requires that each
 local government must establish and efficient and effective internal audit function. In
 accordance with Section 257 of the Local Government Act 2009 Council has resolved to
 delegate this power to the Chief Executive Officer, refer to Noosa Council’s Register of
 Delegations.
 Independence means the freedom from conditions that threaten the ability of the internal
 audit activity to carry out internal audit responsibilities in an unbiased manner.
 Internal Audit refers to an independent, objective assurance and consulting activity
 designed to add value and improve an organisation’s operations. Internal audit assists an
 organisation accomplish its objectives by bringing a systemic disciplined approach to
 evaluate and improve the effectiveness of risk management, control and good governance
 processes.
 Objectivity means an unbiased mental attitude that allows internal auditors to perform
 engagements in such a manner that they believe in their work product and that no quality
 compromises are made.
 Terms of Reference describes the framework within which the internal audit service is
 delivered.
 Internal Audit Plan Is a document that outlines the scope, objectives, and schedule of an
 organisation’s internal audit activities.


 11. HUMAN RIGHTS STATEMENT

 In developing this Policy, the subject matter has been considered in accordance with the
 requirements of the Queensland Human Rights Act 2019. It is considered that the subject
 matter does not conflict with any human rights and supports a human rights approach to
 decision making by Council. Council representatives will endeavor to act and make decisions
 under this Policy in a manner that is compatible with human rights. In particular,
 representatives will endeavor to:
        identify relevant human rights which may be affected by the action or decision;
        give proper consideration to the impact of its actions and decisions on human rights;
       and
        ensure that any conduct or decision by Council which limits an individual’s human
       rights is reasonable and justifiable.

This Policy should be read in conjunction with Council’s Human Rights Policy.

 Version control:
 Version     Reason/ Trigger                 Change (Y/N)   Endorsed/ Reviewed by   Date
 1.0         New policy                                     Council                 20 November 2014


                                                                                        Page 5

Page 6

INTERNAL AUDIT POLICY



 1.1       Update Policy   Y   Council                   27 August 2015
 1.2       Update Policy   Y   Council                   17 November 2016
 1.3       Update Policy   Y   Council                   19 October 2017
 1.4       Update Policy   Y   Council                   20 December 2018
 1.5       Review          Y   Council / A&RCommittee    19 March 2020
 1.6       Review          Y   Council / A&RCommittee    18 March 2021
 1.7       Review          Y   Council / A&R Committee   17 March 2022
 1.8       Review          Y   Council




                                                             Page 6

Page 7

INTERNAL AUDIT POLICY



                                                                              ATTACHMENT 1

                    INTERNAL AUDIT TERMS OF REFERENCE
1. Introduction
The Internal Audit Terms of Reference is an attachment to the Internal Audit Charter and
supports Noosa Council’s objectives of
“Providing robust governance systems to build and strengthen community trust, supported by
the implementation of an Enterprise Risk and Opportunity Management Framework.”
“Open and transparent practices will continue to strengthen community confidence and trust
with council.”


2. Internal Audit Resourcing
The Internal Audit function will be undertaken by a suitably qualified and experienced internal
auditor who may be appointed as a council employee or be a contracted external service
provider appointed through a competitive procurement process in accordance with Council’s
Procurement Policy. The term of appointment of the internal auditor shall be reviewed by the
Chief Executive Officer at least every two years.
The annual budget provision for the Internal Audit function will be determined in the adoption
of the Noosa Council Annual Budget.
The internal audit function reports to the Chief Executive Officer who is supported by the Office
of the CEO and Mayor in co-ordinating internal audit activities, this includes scheduling internal
audits, managing contractual arrangements, liaising with the Internal Auditor, reviewing
internal audit documentation and management responses, monitoring progress in the
implementation of management actions and reporting internal audit performance to the Audit
and Risk Committee.


3. Scope and Objective of Internal Audit
The internal audit coverage may extend to all areas of the organisation and include financial,
accounting, administrative, information management, computing, and other operational
activities. The work of internal audit is to ensure that relevant internal controls are in place
throughout all of Council’s activities and that risks are effectively managed.
The extent and frequency of internal audits will depend upon varying circumstances such as
the results of previous audits, relative risk associated with activities, materiality, the adequacy
of the system of internal control, emerging risks and available resources.
The objective of Internal Audit is to provide Council with independent advice in relation to:
   a) Reviewing and appraising the adequacy and effectiveness of the system of internal
      controls.
   b) Appraising the relevance, reliability and integrity of management, financial and
      operating data and reports.
   c) Reviewing the systems established to ensure compliance with those policies, plans,
      procedures, statutory requirements, and regulations which could have a significant
      impact on operations.

                                                                                           Page 7

Page 8

INTERNAL AUDIT POLICY



    d) Reviewing the means of safeguarding assets and, as appropriate, verifying the
       existence of such assets.
    e) Appraising the economy, efficiency and effectiveness with which resources are
       employed.
    f) Reviewing operations or programs to ascertain whether results are consistent with
       Council’s established objectives and goals and whether the operations or programs
       are being carried out as planned.
    g) Monitoring and evaluating governance processes.
    h) Assessing the adequacy of established systems and procedures.
    i) Conducting special assignments and investigations into any matter or activity affecting
       the probity, interests, and operating efficiency of the organisation.
    j) Reporting significant risk exposures and control issues, including fraud risks,
       governance issues, and other matters needed or requested by the CEO and/or Audit
       and Risk Committee.
    k) The improvement and effectiveness of risk management, legal compliance, internal
       control, and governance systems to provide value and accountability to ratepayers.


4. Internal Audit Model
The internal audit function may be delivered in house or outsourced to a proficient external
provider under a contractual arrangement, independent of Council’s operations. The preferred
model will be determined by Council in consideration of the most effective and efficient option
given Council’s operating environment, business needs, risk profile and appetite, and
resourcing capacity.


5. Annual Internal Audit Plan
In accordance with Section 207 of the Local Government Regulation 2012, Council is required
to prepare an Internal Audit Plan for each financial year stating:
   I.   the way in which Council’s operational risks have been evaluated,
  II.   the most significant operational risks identified from the evaluation, and
 III.   the control measures that Council has adopted, or is to adopt, to manage the most
        significant operational risks.
The development of the Annual Audit Plan and forward program will improve audit planning
and assist in the effective utilisation of audit resources and risk management. The Internal
Audit Plan will be endorsed by Council on the recommendation of the CEO and the Audit and
Risk Committee. A risk-based methodology will be used to identify and prioritise potential audit
areas and progress in implementing the Plan will be reviewed by the Audit and Risk Committee
quarterly. If necessary, management in consultation with the Audit and Risk Committee may
recommend adjustments to the Plan in response to organisational changes that may affect
the organisation’s risk profile or resource requirements.


6. Engagement Planning
The Internal Auditor will document a plan for each engagement/audit. The plan is to be
endorsed by the Chief Executive Officer and will include the audit’s objectives, scope,



                                                                                        Page 8

Page 9

INTERNAL AUDIT POLICY



methodology including key activities to be undertaken, timeframes and deliverables, resource
allocations and an acknowledgement of Council’s needs and preferred approach.
In planning the engagement, the Internal Auditor must consider:
       a) The strategies and objectives of the activity being reviewed and how the activity
       controls its performance.
       b) The significant risks to the activity’s objectives, resources and operations, Council’s
       Risk and opportunity Management Framework including Council’s risk appetite and
       risk tolerances, and how the potential impact of risk is kept to an acceptable level.
       c) The adequacy and effectiveness of the activity’s governance, risk management and
       control processes compared to a relevant control framework or model, and
       d) The opportunities for making significant improvements to the activity’s governance,
       risk management and control processes.


7. Audit Methodology
Internal audits will be conducted in accordance with the Standards for the Professional
Practice of Internal Auditing including the Global Internal Audit Standards which came into
effect on 9/1/25.
The audit process will be guided by various methodologies depending on the organisation’s
needs and objectives. These methodologies include:
   a) Risk-Based Internal Audit (RBIA) methodology is a strategic approach that prioritizes
      auditing efforts based on the risks that pose the greatest threat to an organisation’s
      objectives. This methodology aligns audit activities with the organisation’s strategic
      goals, focusing resources on areas most likely to impact the success of the
      organisation.
   b) Systems or Process-based Internal Audit Methodology focuses on evaluating the
      effectiveness and efficiency of organisational processes. This approach ensures that
      processes are well-designed, properly managed, and aligned with the organisation’s
      strategic goals. By examining each stage of a process, from inception to completion,
      auditors can identify inefficiencies, non-compliance with established procedures, and
      opportunities for improvement.
   c) Compliance Audit Methodology assesses an organisation’s adherence to external
      regulations, internal policies, and industry standards. This approach ensures that the
      organisation operates within legal and ethical boundaries, aligning its operations with
      prescribed norms and requirements. Compliance audits are crucial for maintaining the
      integrity and reputation of an organisation, as they help identify areas of non-
      compliance that could lead to legal penalties or reputational damage.


8. Internal Audit Reporting Process
The Internal Audit function is directly responsible to the Chief Executive Officer and will report
the results of internal audits to the Chief Executive Officer and Audit and Risk Committee as
broadly described hereunder:




                                                                                          Page 9

Page 10

INTERNAL AUDIT POLICY



   a) Reports will consist of an Executive Summary and a Detailed Audit Report. Also, the
      reports will incorporate statements as to the objective, scope and nature of the audit,
      audit conclusions, appropriate recommendations for improvement and associated risk
      assessments aligned to council’s Risk Rating Criteria and Risk Rating Matrix and
      acknowledge good practice and any remedial action in process.

   b) Matters arising during audits, including matters for possible inclusion in reports will, on
      completion of the audit, be discussed with the appropriate with the responsible
      Manager.

   c) Matters resolved at the time of the internal audit will be listed in the issued audit report
      for transparency.

   d) At the completion of an audit, the Internal Auditor will discuss their findings and
      recommendations with the appropriate officers concerned to ensure that internal audit
      and management agree on the findings and jointly develop any recommendations
      considered necessary. Recommendations should be developed with the following
      considerations:
           Timeframes should be realistic and achievable to ensure there is sufficient time
             for findings to be considered and to develop appropriate responses.
           Recommendations should be clearly defined and actionable.
           Recommendations should contain simple actions and be singularly identified
             allowing progress to be easily tracked.
           Dependencies or prerequisite requirements that impact the implementation of
             recommended actions should be identified.
           Resourcing and organisational capacity.

   e) For significant recommendations requiring considerable investment or resources,
      identify immediate controls or activities that can be implemented to reduce risk until full
      action can be completed so as to ensure immediate steps are taken to mitigate risks.

   f)   A draft audit report will be provided, and a meeting arranged with the relevant
        manager/stakeholders to discuss the audit findings. Management responses to the
        audit recommendations will then be developed and provided to the internal auditor
        within 21 days of the draft report being issued or otherwise as agreed.

   g) The Internal Auditor will issue a final report to the Chief Executive Officer for
      presentation to the next Audit and Risk Committee meeting. Depending on the timing
      of Committee Meetings a draft report may be presented for the Committee’s
      information and to provide an opportunity for the Committee to clarify or provide
      feedback on information contained within the draft report.

   h) At the request of the Audit and Risk Committee (in consultation with the CEO), the
      Internal Auditor may be required to provide a report summarising significant issues
      arising out of audits undertaken during the year. They may also be required to provide
      independent verification that any high-risk issues have been addressed, and to
      undertake an assessment of the implementation of audit recommendations. The report
      may include reference to areas where weaknesses were encountered, suggested
      remedial measures and any general observations or recommendations considered



                                                                                         Page 10

Page 11

INTERNAL AUDIT POLICY



        appropriate, a summary of management actions taken or not taken in response to audit
        recommendations and any recommendations to close management actions.

   i)   Progress in implementing internal audit actions and any associated issues will be
        reported to the Audit and Risk Committee at each Committee meeting.


9. Responsibilities


Council and Chief Executive Officer
Council has delegated the following powers to the Chief Executive Officer Noosa Council:

       S105(1) LG Act 2009.
        Power to establish an efficient and effective internal audit function to the CEO.

       S207 LG Regulation 2012
        Power to: -
                 (a) prepare an internal audit plan
                 (b) carry out an internal audit
                 (c) prepare a progress report for the internal audit
                 (d) assess compliance with the internal audit plan
                 (e) give the documents referred to in subsection (3) to the Audit and Risk
                 Committee.


Audit and Risk Committee
In accordance with S 105 (3) of the LG Act 2009 the Audit and Risk Committee is required to
monitor and review the Internal Audit function and the effectiveness and objectivity of council’s
internal auditors.
This includes:
        a) Endorsing the annual Internal Audit Plan.
        b) Reviewing internal audit reports and findings.
        c) Reviewing the status of the follow up and the implementation of recommendations.
        d) Reviewing internal audit plans and the extent to which the planned audit scope can
           be relied upon to detect weaknesses in internal control, risk, fraud or other illegal
           acts.
        e) Assessing the performance of the Internal Audit function.
        f) Advising Council about the level of resourcing for the internal audit function.
        g) Identifying emerging issues and priorities for internal audit.




                                                                                        Page 11

Page 12

INTERNAL AUDIT POLICY



10. Independence
To be effective, the Internal Audit function must be able to operate without being influenced or
restricted when undertaking its responsibilities. For this purpose, the Internal Audit function
reports directly to the Chief Executive Officer.


11. Authority
The Internal Auditor, in the course of their duties, have full, free and unrestricted access to all
records, monies, materials, assets, property and personnel and are permitted to examine all
transactions, review all policies, procedures and functions in Council. Information acquired by
the Internal Auditor during an audit must remain confidential and must not be used for
purposes outside the scope of the audit review. All members of management and staff must
fully co-operate with the Internal Auditor in relation to matters subject to review.
The Internal Audit function shall be performed by proficient and experienced auditor/s who
hold a level of professional membership as outlined below:

   Ordinary membership or above of the Institute of Internal Auditors in Australia or
   CPA or above (CPA Australia) or
   CA or above (Chartered Accountants Australia and New Zealand) or
   IPA or above (Institute of Public Accountants)
The Internal Auditor also has direct access to the Chair of the Audit and Risk Committee, as
required.


12. Relationship between Internal Audit and External Audit
In accordance with the Financial Accountability Act 2009 all Queensland public sector
organisations are to be held accountable for the administration of the state’s finances and
are subject to a financial audit each financial year. The Queensland Audit Office (external
audit) undertakes financial and performance audits relating to Council’s financial reports and
performance audits which focus on the performance of public sector entities, and how
effectively, efficiently, and economically their objectives are being met. The Internal Audit
function will collaborate with External Audit with respect to all internal audit engagements
conducted, as required, to facilitate the audit coverage and avoid duplication of work. Both the
Internal Auditor and External Auditor may approach the Audit and Risk Committee
Chairperson directly at any time.


13. Management Actions
The relevant operational Manager is responsible for ensuring that corrective action on
recommendations made or deficient conditions reported by the Internal Auditor and External
Auditor are completed within the agreed timeframes. The Audit and Risk Committee will
monitor the implementation of audit recommendations. Recommendations are considered
outstanding until audit actions or hold a status of ‘complete’ and the deficiency is rectified.
The progress of implementing recommendations and associated actions is reported to the
Audit and Risk Committee on a quarterly basis. If the operational Manager foresees difficulties
implementing the recommendations within the agreed time frame, the Manager should advise

                                                                                          Page 12

Page 13

INTERNAL AUDIT POLICY



the relevant Director and the Chief Executive Officer regarding the cause of the delay and
obtain approval to the revised implementation schedule. The relevant Director is ultimately
responsible for the effective and timely action and responses on all Internal Audit and External
Audit observations and recommendations.


14. Evaluation of Internal Audit Performance
The Chief Executive Officer and Audit and Risk Committee will undertake periodic evaluations
of the performance of the Internal Audit function. Relevant considerations are:
   -   Compliance with the revised global Internal Audit Standards (effective from 9/1/25)
       relating to the importance of having appropriate governance arrangements to enable
       the internal audit function to be effective.
   -   How internal audit has delivered against the Internal Audit Plan and the quality of the
       results of its testing.
   -   The results of Internal Audit’s work.
   -   Management’s responsiveness to Internal Audit’s findings and recommendations.
   -   The level of client satisfaction with the Internal Auditor’s performance as determined
       by a client satisfaction survey to be undertaken at the conclusion of each internal audit.




                                                                                        Page 13