Review Of The Audit And Risk Committee Charter & Review Of The Internal Audit Policy · Attachment 2_Internal Audit Policy_Draft

INTERNAL AUDIT POLICY



methodology including key activities to be undertaken, timeframes and deliverables, resource
allocations and an acknowledgement of Council’s needs and preferred approach.
In planning the engagement, the Internal Auditor must consider:
       a) The strategies and objectives of the activity being reviewed and how the activity
       controls its performance.
       b) The significant risks to the activity’s objectives, resources and operations, Council’s
       Risk and opportunity Management Framework including Council’s risk appetite and
       risk tolerances, and how the potential impact of risk is kept to an acceptable level.
       c) The adequacy and effectiveness of the activity’s governance, risk management and
       control processes compared to a relevant control framework or model, and
       d) The opportunities for making significant improvements to the activity’s governance,
       risk management and control processes.


7. Audit Methodology
Internal audits will be conducted in accordance with the Standards for the Professional
Practice of Internal Auditing including the Global Internal Audit Standards which came into
effect on 9/1/25.
The audit process will be guided by various methodologies depending on the organisation’s
needs and objectives. These methodologies include:
   a) Risk-Based Internal Audit (RBIA) methodology is a strategic approach that prioritizes
      auditing efforts based on the risks that pose the greatest threat to an organisation’s
      objectives. This methodology aligns audit activities with the organisation’s strategic
      goals, focusing resources on areas most likely to impact the success of the
      organisation.
   b) Systems or Process-based Internal Audit Methodology focuses on evaluating the
      effectiveness and efficiency of organisational processes. This approach ensures that
      processes are well-designed, properly managed, and aligned with the organisation’s
      strategic goals. By examining each stage of a process, from inception to completion,
      auditors can identify inefficiencies, non-compliance with established procedures, and
      opportunities for improvement.
   c) Compliance Audit Methodology assesses an organisation’s adherence to external
      regulations, internal policies, and industry standards. This approach ensures that the
      organisation operates within legal and ethical boundaries, aligning its operations with
      prescribed norms and requirements. Compliance audits are crucial for maintaining the
      integrity and reputation of an organisation, as they help identify areas of non-
      compliance that could lead to legal penalties or reputational damage.


8. Internal Audit Reporting Process
The Internal Audit function is directly responsible to the Chief Executive Officer and will report
the results of internal audits to the Chief Executive Officer and Audit and Risk Committee as
broadly described hereunder:




                                                                                          Page 9