Internal audit should be seen a valuable aid to managers, not just a check on their probity. A progressive internal audit function will welcome opportunities to help improve how things are set up, rather than simply judging any inadequacies 'after the event'. Such broad involvement ought to help both managers and auditors, who are then better linked to the change issues which matter to the organisation and major areas of risk. NHS bodies all have a duty to secure adequate internal audit coverage which follows PSIAS, the volume of which is determined by their audit committee and board and, to a limited extent, the requirement to support external audit. Having set that level, it makes sense for economy and effectiveness alike to use internal auditors to carry out consultancy work, the more so if they can substitute for external resource.
In order to understand the current position we felt it was important to have a baseline understanding of the service provision and usage. We began by surveying NHS provider organisations, asking the following questions:
The size of internal audit provision has been judged based on the number of days contracted. To take account of organisational scale and complexity, this has been looked at per £m turnover. It is acknowledged that there is an element of ‘overhead’ involved regardless of organisational size, however this has not been adjusted for due to differences of opinion regarding the size of this central resource.
Lowest - 0.4 days per £m turnover.
Highest – 3.1 days per £m turnover.
Average – 1.04 days per £m turnover.
Costs also vary significantly therefore a larger number of days doesn’t necessarily relate to a higher overall cost. From 2015/16 NHS providers have (in the main) included the costs of internal audit in their annual accounts. Comparison of the 2015/16 reported costs with the number of days contracted suggests daily rates vary significantly between approximately £300 and £700 per day with an average of approximately £450.
Traditionally, most NHS provider organisations employed their own internal auditors either as a standalone organisation or more commonly across a former health authority area. Many of these former internal providers have merged to form consortia – some of which are hosted by NHS bodies (in house consortia) whilst others have formed their own standalone organisations (standalone consortia). Accountancy and audit firms also provide internal audit services. The graph below shows the breakdown between these three categories across the organisations completing the survey:
There is no clear pattern in the number of days or cost per day for the three groups, although general themes emerge. In house consortia tend to have the lowest cost per day and the highest number of days, vice versa for provision by firms with standalone consortia lying between the two.
The survey was originally sent out to health providers in England, however following prompts in our Health and Integration newsletter we received a number of submissions from Scotland and a few from Wales, which were much appreciated. These revealed some interesting differences: due to the health board structure which does not have the commissioner provider split, health bodies in Scotland are much larger than those in England and although their internal audit provision is large, relative to the size of the budget is generally lower – as low as 0.2 days per £m for one of the larger health boards. Counter fraud is also commissioned centrally in Scotland, rather than being sourced and managed at individual organisational level. These differences raise interesting questions of cost effectiveness, which could be considered in the emerging Sustainability and Transformation Plans (STPs) and Accountable Care Organisations (ACOs) in England.
This initial research suggests that there are significant differences between trusts in the extent of and type of use of internal audit. Inclusion of the costs of internal audit, alongside external audit and consultancy in the accounts will allow a greater degree of comparison which will shape our thinking in this area.
We are establishing a Special Interest Group to look further at the role of internal audit as well as CIPFA’s role in supporting the internal audit community across the public sector. It will also help to shape CIPFA’s thought leadership on internal audit.
If you are interested in taking part in this, or would like to share your thoughts and comments on this topic please contact E: firstname.lastname@example.org
Find out more about CIPFA's Internal Audit Services: