THE CHALLENGE

In 2010, the Office of Local Government, (at that time called the Department of Local Government) issued guidelines for Internal Audit. While the document was referred to as ‘guidelines’ the Office of Local Government had stated that in order for councils to meet best practice standards, all councils should have an internal audit function.

During this time, the Office of Local Government was reviewing local councils’ governance procedures and providing recommendations. For Wollondilly Shire Council, one recommendation was to introduce an internal audit function.

Manager of Governance, John Sproule, and Council’s management team were eager to enhance Wollondilly Shire Council’s risk management framework by adding an internal audit function to meet best practice standards.

But where to start?

For the relatively small but rapidly growing Wollondilly Shire Council, employing a full time auditor was not going to be cost effective and would not have allowed for the specific skills and depth required to audit a council with such a diverse range of functions.

Wollondilly Shire Council wanted high quality, thorough, flexible and skilled internal audit services delivered cost effectively by an organisation with the experience and expertise that would allow it to ‘hit the ground running’. That way audits could be completed on time and on budget to maximise value to ratepayers.

THE SOLUTION

Wollondilly Shire Council selected InConsult to undertake their internal audits because of our ability to deliver a cost effective solution, conducted by experienced consultants with the depth and specialisation Council required. “It came down to finance and resourcing. We wanted the flexibility of a tailored approach that would meet our specific needs while staying within a modest budget.” said Mr Sproule.

InConsult was engaged to support Wollondilly Shire Council with the initial planning and implementation of an internal audit function, developing the strategic audit plan and conducting audits over a three year period.

InConsult started by obtaining a good understanding of the organisation and conducting meetings and discussions with management, staff and key stakeholders, to develop a risk based Strategic Audit Plan.  Once the Strategic Audit Plan was approved by Council, InConsult began conducting a series of internal audits to review and evaluate Council’s key internal controls to test their effectiveness and appropriateness. After each audit, InConsult produces an internal audit report highlighting good work Wollondilly Shire Council is already doing and making recommendations for any improvement required in the internal control framework. Each recommendation is discussed with the auditee and prioritised for attention, based on the level of risk.

THE RESULT

The main benefit to Wollondilly Shire Council from outsourcing the internal audit function has been having an experienced team with specialised skills completing the audits to give Council a value for money services that meets best practice standards.  “Having our audits outsourced means we get the depth and expertise we were looking for within a modest budget so rate payer funds can be channelled into community projects and services.” Mr Sproule explained.

Additionally, Council has benefited from InConsult’s expertise and recommendations for improving policies and procedures, which has further strengthened Wollondilly Shire Council’s strong risk management framework and culture. “The audits have really engaged our staff, councillors and audit committee members. Whilst they were always supportive of creating a strong internal control framework, having an external party review or processes has resulted in more transparency and generated genuine interest in audit reports and recommendations.” said Mr Sproule.

By adding an internal audit function, Wollondilly Shire Council is now operating within best practice standards. The introduction of an internal audit function has added an extra level of assurance to Council’s activities and acts as a monitoring exercise for processes and policies, all of which enhances the already strong risk management culture. Outsourcing the audits to a professional, expert and experienced organisation offered Council an in-depth, targeted and value for money internal audit function.

Shellharbour is a city located approximately 100 kilometres from the centre of Sydney. It is a growing community of around 67,000 residents and key strategic assets include Illawarra Regional Airport and the $1.5 billion dollar Shell Cove Project which is a tourist and residential development encompassing a modern boat harbour, 20 hectares of waterway, 1.5km of harbour front promenade featuring retail outlets, restaurants and residential developments.

Some years ago, Group Manager Finance, Tony Gearon and the Risk Management team began a gradual process of “cultural overhaul” through the introduction of new processes, encouraging both staff and management to enhance Council’s risk management function with the establishment of an internal audit function.

At the time, there was little understanding of the benefits of internal audit and the potential value to Council. Fortunately in 2010, the Department of Local Government introduced guidelines on internal audit and best practice risk management principles that provided the impetus for Council to establish an internal audit function.

As Tony describes, “As the benefits of Enterprise Risk Management were being proven at the same time at Shellharbour, it was felt that establishing an internal audit function would be complimentary, the two functions would fit together hand in glove.”

THE SOLUTION

Shellharbour City Council looked at the options available in setting up an internal audit function.  Council wanted a trusted and independent organisation to comprehensively review and evaluate the Council’s activities and processes in a way that would add value and make staff and management feel comfortable. Council’s preferred option was to outsource internal audit to an external organisation; this was seen as the most cost effective option as well as a way to make internal audit more independent. After a scrupulous tender process, InConsult was chosen based on extensive staff expertise, reasonable pricing, reputation, ability to add value to risk management and strong emphasis on building excellent working relationships with clients.

InConsult started by obtaining a good understanding of the organisation and conducting meetings and discussions with management, staff and key stakeholders, to develop a risk based Strategic Audit Plan.  InConsult also provided guidance to Council as it established its Governance, Risk and Audit Committee. Once the audit plan was approved, InConsult began conducting a series of internal audits to review and evaluate Council activities to test their effectiveness and appropriateness. After each audit, InConsult produces internal audit reports highlighting good work Shellharbour City Council is already doing and making recommendations for any improvement required in the internal control framework. Each recommendation is discussed with the auditee and prioritised for attention, based on the level of risk.

THE RESULT

Today, internal audit is embraced by all levels of management.  InConsult interacts with staff at all levels without being intimidating or making staff feel uncomfortable about having their systems and processes reviewed.

According to Tony, “staff are encouraged to use the audits as a reference for future improvements. The internal audit reports are clear and easy to understand.” As part of the internal audit KPIs adopted by the Governance Risk and Audit Committee, an annual survey of Committee members and senior staff is undertaken. The most recent survey indicated a high level of satisfaction with the internal audit function and agreement that it has improved Council’s internal control framework.

“Internal audit is seen as an important third line of defence for Council.  It has enabled stakeholders such as councillors and Governance, Risk and Audit Committee members to have greater visibility over Council’s risk management and internal control frameworks”.

Aligning the risk management framework with internal audit activities has also helped to improve risk analysis across departments and major projects. “It has improved the risk culture and awareness of risk, which in turn helps people to think about what could go wrong and to be more analytical in their thinking and decision making”.