·

Internal Audit Progress Report

New Forest District Council – September 2025

1. Internal Audit Mandate

The mandate for internal audit in local government is specified within the Accounts and Audit [England] Regulations 2015, which states:

‘5. (1) A relevant authority must undertake an effective internal audit to evaluate the effectiveness of its risk management, control and governance processes, taking into account public sector internal auditing standards or guidance.

(2) Any officer or member of a relevant authority must, if required to do so for the purposes of the internal audit—

(a) make available such documents and records; and

(b) supply such information and explanations

as are considered necessary by those conducting the internal audit.’

The role of internal audit is best summarised through its definition within the Standards, as an:

‘An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes.’

The Council is responsible for establishing and maintaining appropriate risk management processes, control systems, accounting records and governance arrangements. Internal audit plays a vital role in advising the Council that these arrangements are in place and operating effectively.

The Council’s response to internal audit activity should lead to the strengthening of the control environment and, therefore, contribute to the achievement of the organisation’s objectives.

2. Internal Audit Standards

With effect from 1 April 2025, the ‘Standards’ against which internal audit within the public sector must conform are those laid down in the Global Internal Audit Standards, Application Note: Global Internal Audit Standards in the UK Public Sector and the Code of Practice for the Governance of Internal Audit in UK Local Government. The collective requirements are referred to as the Global Internal Audit Standards in the UK Public Sector.

3. Purpose of Report

In accordance with proper internal audit practices (Global Internal Audit Standards in the UK Public Sector), and the Internal Audit Charter the Chief Internal Auditor is required to provide a written status report to Senior Management and the Audit Committee, summarising:

o The monitoring of ‘live’ internal audit reports

o an update on progress against the annual audit plan and any subsequent revisions

o acknowledgement of any actual or perceived impairments to internal audit independence

o internal audit performance, planning and resourcing issues

o results of audit assignments and insights.

Internal audit reviews culminate in an opinion on the assurance that can be placed on the effectiveness of controls in place focusing on those designed to mitigate risks to the achievement of management objectives of the service area under review. Assurance opinions are categorised as follows:

Substantial	A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited.
Reasonable	There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited.
Limited	Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited.
No	Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited.

4. Resourcing

As Chief Internal Auditor I maintain responsibility for ensuring that there is a sufficient level of resource available, supported by an appropriate range of knowledge, skills, qualifications and experience to deliver the internal audit plan (2025-26) and in the fulfilment of the audit mandate and delivery of the internal audit strategy. 

o Human Resource - the Southern Internal Audit Partnership has access to an appropriate range of knowledge, skills, qualifications and experience required to deliver the internal audit strategy and risk-based audit plan.

o Financial Resource - the Head of Southern Internal Audit Partnership will manage the internal audit budget to enable the successful implementation of the internal audit mandate and achievement of the plan.  The budget includes the resources necessary for the function’s operation, including training and relevant technologies and tools.

o Technological Resource - the internal audit function has the technology to support the internal audit process and regularly evaluates technological resources in pursuit of opportunities to improve effectiveness and efficiency.

The Southern Internal Audit Partnership are currently experiencing a higher than average level of attrition resulting in vacancies at auditor, senior auditor and audit manager level.

With the time lapse between an individual leaving the organisation and the recruitment and onboarding of new staff there will be an inevitable impact on capacity over the short-term.

The Southern internal Audit Partnership have contingency arrangements in place to mitigate such eventualities with opportunity to attain additional support through peer Partnerships or established frameworks.

Whilst there will be no financial impact to New Forest District Council, there may be some minor slippage in delivery of the quarter 2 / 3 plan whilst contingency arrangements are put in place.

Recruitment across existing vacancies is well progressed and I remain confident as your chief internal auditor that the 2025-26 internal audit plan will be sufficiently delivered enabling me to provide a timely Annual Conclusion.

5. Independence

As your chief internal auditor, I retain no roles or responsibilities that have the potential to impair my independence, either in fact or appearance.  Internal auditors engaged in the delivery of the 2025-26 internal audit plan have had no direct operational responsibility or authority over any of the activities reviewed.   I can confirm there has been no interference encountered relating to the scope, performance, or communication of internal audit work during the year to date in the delivery of the internal audit plan or the fulfilment of the internal audit mandate.

6. Impairments

There have been no impairments to internal audit activity during the year.  The internal audit function has remained free from all conditions that threaten our ability to carry out responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication.   The internal audit team have maintained an unbiased mental attitude allowing them to perform engagements objectively enabling them to believe in their work product, with no compromise to quality, and no subordination to their judgment on audit matters, either in fact or appearance.

7. Rolling Work Programme

The internal audit plan for 2025-26 was originally presented to Senior Management and approved by the Audit Committee in March 2025.   The audit plan remains fluid to provide a responsive service that reacts to the changing needs of the Council. Progress against the plan is detailed below.

Audit Review	Sponsor	Scoping Held	ToR Issued	Fieldwork Start	Draft Report	Final Report	Assurance Opinion	Comment
Partnership Working – Town and Parish Councils	ADPO	02.09.24	07.10.24	11.11.24	12.05.25		Limited	Included within 24-25 Annual Conclusion Report therefore excluded from 25-26 performance.
Environmental Enforcement - Clean Streets	SDH&C	30.11.23	16.01.24	03.03.24	20.12.24		Limited	Included within 24-25 Annual Conclusion Report therefore excluded from 25-26 performance.
Cemeteries	ADPO	15.11.24	05.12.24	07.01.25	28.02.25		Reasonable	Included within 24-25 Annual Conclusion Report therefore excluded from 25-26 performance.
Keyhaven – Income & PCard Expenditure	SDH&C	10.12.24	20.01.25	20.01.25	24.04.25		Reasonable	Included within 24-25 Annual Conclusion Report therefore excluded from 25-26 performance.
Corporate Plan and Performance Management	ADT	08.01.25	09.05.25	19.05.25	11.07.25	30.09.25	Substantial
Transformation Programme	ADT	30.07.25	03.09.25 (draft)
Corporate Governance Framework – Complaints	SDCR&T	15.05.25	04.06.25	30.06.25	05.09.25
Asset Management – Corporate Estate	SDCR&T							Q4
Investment Property Management	SDCR&T	13.08.25	30.09.25 (draft)
Information Governance	SDCR&T							Q4.
Procurement	ADFIN	11.09.25	29.09.25 (draft)
Business Continuity	SDH&C							Scoping 06.10.25
Emergency Planning	SDH&C							Scoping 06.10.25
Risk Management	ADT							Q4
HR – Workforce Strategy and Wellbeing	ADT							Scoping 16.10.25
Safeguarding	SDH&C	22.09.25
Treasury Management	ADFIN	12.12.24	27.01.25	12.05.25	10.09.25
Council Tax	SDCR&T	16.07.25	30.07.25	12.08.25	30.09.25
Accounts Receivable & Debt Management	ADFIN							Q4
Main Accounting and Reconciliations	ADFIN	16.09.25
IT – Firewall Management and Monitoring	ADT	23.01.25	24.02.25					Delayed due to SIAP resource availability
Cyber Security Training and Awareness	ADT	13.05.25	23.06.25	14.07.25	22.09.25
IT Disaster Recovery and Service Continuity	ADT							Scoping 06.10.25
Application Product Management	ADT							Q3
Vulnerability Management	ADT							Q4
Licencing (Temporary Event Notices, Premises and Personal Licenses)	SDH&C	06.02.25	03.04.25	12.05.25	30.07.25	26.08.25	Substantial
Planning/Development Management	SDPOS	31.07.25	29.09.25
Building Control	SDPOS							Q4
Engineering works	ADPO	23.06.25	05.08.25	04.09.25
Taxi Licencing	SDH&C							Q4
Tenant Engagement	ADH	14.05.25	14.07.25	02.09.25
Housing Asset Management – Analogue to Digital Switchover	ADH							Scoping 22.10.25
Housing Asset Management – Fire Safety	ADH	08.08.25	26.09.25
Open spaces	ADPO							Scoping 22.10.25

Audit Sponsor		Audit Sponsor
Chief Executive	CX	Strategic Director Place, Operations & Sustainability	SDPOS
Assistant Director Strategy and Engagement (Monitoring Officer)	ADS&E	Assistant Director Place Operations	ADPO
Strategic Director Corporate Resources & Transformation (S151)	SDCR&T	Assistant Director Place Development	ADPD
Assistant Director Finance	ADFIN	Strategic Director Housing & Communities	SDH&C
Assistant Director Transformation	ADT	Assistant Director Housing	ADH

8. Adjustment to the Internal Audit Plan 2025-26

Internal Audit focus continues to be proportionate and appropriately aligned.  The plan remains fluid and subject to on-going review and amendment, in consultation with the relevant audit sponsors, Senior Management, and the Audit Committee, to ensure internal audit are able to react to new and emerging risks and the changing needs of the Council. 

Such amendments to the 2025-26 internal audit plan are detailed below with explanations for the proposed amendments.

Additions	Audit Review	Reason for inclusion in the plan
	Not applicable	Not applicable
Withdrawals	Audit Review	Reason for removal from the plan
	Not applicable	Not applicable

9. Acceptance of Risk

Internal audit reporting protocols are in place to ensure that the scope of work and findings for all assignments are reported appropriately and that agreed management actions are approved by senior management. 

Every effort will be made to resolve disagreements that may arise during the audit process. However, if, unresolved issues are considered by internal audit to fall outside of the Council’s risk tolerance, these will be escalated to Senior Management and the Audit Committee as deemed necessary.

There are no such instances to report from our delivery of the 2025–26 internal audit plan to date.

10. Executive Summaries of reports published concluding a ‘Limited’ or ‘No’ assurance opinion

There have been no 2025-26 reviews which have concluded with a ‘Limited’ or ‘No’ assurance opinion.

11. Analysis of ‘Live Audit Reviews’

Audit Review	Report Date	Audit Sponsor	Assurance Opinion	Management Actions
				Agreed	Pending	Complete	Overdue

				L	M	H	L	M	H	L	M	H	L	M	H
Fleet Management (follow-up phase 2)	22.05.23	ADPO	Reasonable	2	3	4	-	-	-	2	2	4	-	1	-
Open Spaces and Playground Safety Checks	07.12.23	ADPO	Limited	3	7	2	-	-	-	3	4	-	-	3	2
Housing Asset Management – Electrical Safety Checks	07.02.24	ADH	Reasonable	2	4	2	-	-	-	-	4	2	2	-	-
Accounts Payable	13.06.25	ADFIN	Reasonable	2	3	-	-	-	-	2	2	-	-	1	-
Health and Safety	15.11.24	ADT	Reasonable	-	2	4	-	1	-	-	-	3	-	1	1
Budget Planning/Setting	11.12.24	ADFIN	Substantial	2	1	-	1	1	-	1	-	-	-	-	-
HR – Recruitment/Statutory Responsibilities	16.12.24	ADT	Substantial	-	2	-	-	1	-	-	1	-	-	-	-
Housing Enforcement	02.04.25	ADH	Reasonable	1	3	-	-	-	-	-	3	-	1	-	-
Information Governance – Data Retention/Records Management	16.04.25	SDCR&T	Reasonable	6	-	-	6	-	-	-	-	-	-	-	-
Environmental Health - Local Air Pollution Prevention and Control (LAPPC)	03.06.25	SDH&C	Reasonable	3	3	-	3	-	-	-	3	-	-	-	-
Housing Asset Management – Gas Safety	21.08.25	ADH	Reasonable	-	2	5	-	-	1	-	2	4	-	-	-
ICT Project Delivery	04.09.25	ADT	Limited	1	9	3	-	5	-	1	4	3	-	-	-
Corporate Plan and Performance Management	30.09.25	ADT	Substantial	5	4	4	2	2	2	3	2	2	-	-	-
Total				27	43	24	12	10	3	12	27	18	3	6	3

The management team have provided confirmation that all actions have been completed in respect of seven previous audit review areas and are therefore no longer included within the table above.  The respective review areas and report dates are:- Animal Welfare – Licencing (Jun 24), Housing Rent Reconciliations (July 24); Contract Management – Leisure (Nov 24), Payroll & Expenses (Feb 25), Corporate Governance Framework (Mar 25), Housing Asset Management – Lift Inspections (April 25), and Housing Management - Right to Buy (May 25).

Annexe 1

Overdue ‘High Priority’ Management Action

Open Spaces – Playground Safety Checks

Observation: Guidance, policies and operational procedures

There are no current detailed procedure notes or guidance outlining the process and requirements within the Open Spaces Team, for example the criteria and timescales/frequency for maintenance checks. The Public Open Spaces Inspection Criteria Flowchart, which was last updated in Dec 2018, provides details of open spaces equipment to be checked and timescales however it does not appear that the flowchart has been revisited since its inception and there may be scope to reduce visits/inspection to certain sites based on guidance/legislation.

Risk: Hazards will not be identified and eliminated, which could lead to accidents and injuries.

Management Action	Original Due Date	Revised Due Date	Latest Service Update
1.1 Critically review assets and inspection timescales based on ‘Risk and Likelihood’ and formalise site and play equipment inspection schedule. (to be appended to policy, as set out in Action 1.2)	31.03.24	30.10.25 04.02.26	A new Playground Policy, including a review of assets and inspection timescales, has been created and is being further developed following input from Transformation and Housing colleagues. The policy will be considered by Place Overview and Scrutiny Panel on 15 January 26, followed by Cabinet on 04 February 26.
1.2 Open Spaces to draft a Playgrounds and Play Equipment Policy covering the sites and equipment where compliance responsibility rests with Open Spaces. The policy will set out the purpose, legal requirements, responsibilities, methodology, arrangements, and process, set out a review period frequency and append a schedule of sites and equipment. The policy is to be presented to EMT and consulted through safety panels.	31.03.24	30.10.25 04.02.26	The Playgrounds and Play Equipment Policy will be considered by EMT alongside the Playground Policy before progressing to the safety panels.  Extended internal consultation, change in personnel and further development work has resulted in a delay to scheduled timeline. NB There are also three medium priority overdue actions in relation to this audit which should be completed by 04 February 26.

Health & Safety

Observation: Contractor Health and Safety

The Health and Safety policy states that The Council’s corporate Control of Contractors Policy identifies the key services who undertake construction and maintenance projects. The corporate policy requires these services to complete their own specific arrangements for the management of construction projects and the control of contractors. These arrangements must include roles and responsibilities, procedures, training requirements, procurement requirements and template documents.

Testing confirmed that a Control of Contractors policy is in place which includes detail on Health and Safety requirements for contractors, however this was last updated in 2021. The policy requires relevant areas of the Council to produce Standard Operating Procedures (SOPs) to enable compliance with regulations in this area. Testing found that the Operations Service had not yet produced a SOP as required.

Risk: Contractor Health and Safety may not be being addressed appropriately.

Management Action	Original Due Date	Revised Due Date	Latest Service Update
2.1 Review the 2021 Corporate Control of Contractors Policy and communicate throughout the organisation (High priority).	n/a	n/a	This high priority action was completed at the time of the audit.
2.2 Ensure all control of contractors standard operating procedures are reviewed and submitted to the Control of Contractors Working Group for approve. Once approved communicate to all relevant employees (High priority).	01.04.25	TBC	September 2025 update re the high and medium priority actions: Standard Operating Procedures (SOPs) for Corporate Resources and Transformation are complete, held on SharePoint and have been communicated.  Training was provided to all relevant employees in September. SOPs for Housing and Communities have been drafted and are with relevant officers for consultation. SOPs for Place, Operations and Sustainability have been drafted and consultation has been undertaken with relevant services. Additional detail is required in relation to working with other services in the Council such as Housing. The provision of training is dependent upon completion of 2.2.
2.3 Provide additional training on the reviewed standard operating procedures for each directorate (Medium priority).	01.08.25	TBC

Annexe 2

Overdue ‘Low & Medium Priority’ Management Actions

Audit Review	Report Date	Opinion	Priority		Due Date	Revised Due Date
			Low	Medium
Fleet Management (follow-up phase 2)	22.05.23	Reasonable		1	31.03.24	30.11.25
Open Spaces and Playground Safety Checks	07.12.23	Limited		1	31.03.24	30.10.25 04.02.26
				2	31.05.24	30.10.25 04.02.26
Housing Asset Management – Electrical Safety Checks	07.02.24	Reasonable	2		30.04.24	01.10.25 Update requested
Accounts Payable	13.06.24	Reasonable		1	31.03.25	31.03.26
Health and Safety	15.11.24	Reasonable		1	01.08.25	Requested
Housing Enforcement	02.04.25	Reasonable	1		29.08.25	Requested
Total			3	6

Annexe 3

Southern Internal Audit Partnership - Performance Measures

Performance Measure	Regularity	Target	Actual 25-26	Status	Direction of Travel
1. Percentage of the agreed audit plan completed (issue of draft / final report)	Ongoing	90%	20%		n/a
2. Audits delivered within agreed timescales (% year to date)
o To issue of draft report	Ongoing	80%	17%		n/a
o To issue of final report	Ongoing	80%	50%		n/a
3. Conformance with the Global Internal Audit Standards in the UK Public Sector	Annual	Conforms	Conforms*
4. Audits conducted optimising the effective use of data analytics (% year to date)	Ongoing	60%	50%		n/a
5. Stakeholder satisfaction (annual survey)
o Audit Committee	Annual	90%	100%
o Senior Management		90%	94%
o Key Contacts		90%	99%
6. Internal audit effectively communicates with key stakeholders
o Audit Committee	Annual	90%	100%		n/a
o Senior Management		90%	100%		n/a
o Key Contacts		90%	99%		n/a
7. Sufficiency of input to and discussion of the internal audit plan
o Audit Committee	Annual	90%	100%		n/a
o Senior Management		90%	100%		n/a
8. Appropriate focus on key risks
o Audit Committee	Annual	90%	100%		n/a
o Senior Management		90%	100%		n/a
o Key Contacts		90%	100%		n/a

* Any external quality assessment undertaken under the Public Sector Internal Audit Standards remains valid for the duration of the successive five years (from the date it was undertaken). The Southern Internal Audit Partnership will be commissioning an external quality assessment against the Global Internal Audit Standards in the UK Public Sector during 2025.