The development of these new standards was a comprehensive, multiyear process that involved collaboration with thousands of professionals worldwide, including internal audit practitioners, service providers, and international standard-setters. This inclusive approach ensures the standards are both practical and globally relevant.

As organisations continue to navigate a complex business environment, these updated standards are poised to provide internal auditors with a robust framework to deliver greater value, align with organisational goals, and adapt to evolving challenges.

The revised standards aim to elevate the practice of internal auditing by ensuring better performance, enhanced quality, and greater consistency across organisations worldwide.

Key enhancements in the revised standards include:

• Internal Audit Strategy: Emphasis on aligning internal audit activities with organisational objectives to enhance strategic relevance.
• Stakeholder Relationships: Strengthening communication and collaboration with stakeholders to ensure audit activities meet their needs and expectations.
• Performance Measurement and Accountability: Introducing metrics and accountability frameworks to assess and improve internal audit effectiveness.
• Governance Conditions: Defining essential governance structures and practices necessary for effective internal auditing.

Over the past year, these standards have gained significant traction within the global internal audit community. Translated into 25 languages, they have been downloaded nearly 600,000 times, underscoring their broad appeal and importance.

For more analysis, including a step by step guide to adapting the new standards, read our publication New 2024 Internal Audit Standards: Insights for CAEs

For further details about the new standards, visit the official IIA website.

Next Steps

By now, most Chief Audit Executives, have transitioned to their organisation to align with the new 2024 Global Internal Audit Standards.  Many have compared the current practices of the internal audit function with the updated requirements to identify areas of non-compliance or improvement.  What now?

Continue to engage with stakeholders.  Inform the board, audit committee, and senior management about the transition to the new standards and their significance and benefits for your organisation.

“Technology is best when it brings people together and makes work easier.”

At InConsult, we believe that’s exactly what Next-Gen GRC technology should do.

We know that the future of risk management, audit, and compliance lies where deep expertise meets forward-thinking innovation. That’s why we’re excited to welcome Andy Chu as our new Risk Technology & Innovation Lead.

Andy brings a powerful combination of Big 4 consulting experience and a proven track record in technology-driven transformation. With close to a decade at KPMG, Andy worked across assurance, digital consulting, and innovation portfolios. Most recently, he played a key role in NBN Co’s product strategy team. He helped accelerate the adoption of high-speed internet and improve customer experience at scale.

Next-Gen GRC Starts Now

In his new role at InConsult, Andy will lead the ongoing development of our GuardianERM GRC platform, drawing on his strengths in assurance, audit, technology enablement, and risk transformation.

Andy’s focus will include:

• Gathering and prioritising client and market feedback
• Scanning the horizon for emerging technologies and trends
• Identifying more opportunities to enhance GuardianERM’s features, user experience, and value

Supporting Andy is our dedicated GuardianERM engineering and support team. He is also backed by InConsult’s powerhouse of governance, audit, cyber security, AI, and risk management specialists. Together, they bring a depth of knowledge and momentum to help our clients confidently navigate the complex risk and compliance landscape.

With Andy at the helm, GuardianERM is set to evolve in exciting new ways—where the rigour of traditional risk management meets the agility of modern digital tools. Whether it’s enabling internal audit automation, streamlining compliance reporting, or leveraging AI for smarter risk insights, we’re building a platform designed for tomorrow’s challenges.

Watch this space — a new era of Next-Gen GRC innovation is just beginning.

Mitchell’s career spans over four decades, primarily in the NSW public sector, where he held senior roles including Governance Manager, Corporate Services Director and Acting General Manager. He served as Chair of the NSW Local Government Governance Network, was a Board Member of Westpool (now CivicRisk Mutual), and held executive positions at Liverpool, Marrickville (now Inner West), Hornsby, and Fairfield Councils.

Mitchell joined InConsult in 2008, at a time when we had just a handful of local government clients. Bringing with him deep expertise across corporate governance, probity, records and privacy management, insurance, risk management, internal audit, and administrative services, Mitchell worked tirelessly to establish InConsult as a trusted partner to local government. Thanks largely to his knowledge, leadership and commitment, InConsult now works with 115 of NSW’s 128 councils.

Mitchell’s experience, insight, steady leadership and thoughtful approach have been a cornerstone of our success. As a Director, he brought balance and perspective to our Board, enriching our strategic decision-making. He also led our internal audit and assurance engagements with professionalism, precision and an unwavering commitment to client outcomes. A standout achievement was guiding one of our clients to a prestigious risk management award.

A prolific thought leader, Mitchell has authored numerous articles on governance, audit, and risk, and presented at conferences across Australia and overseas. He continues to serve as an independent member on several Audit and Risk Committees.

Beyond the boardroom, Mitchell loves sport – Golf, horse racing, rugby league (go Parramatta) and “Aussie Rules” (go Hawthorn).  Mitchell has long been an active figure in his local community, contributing as a player, coach, and committee member in grassroots sports.

As he embarks on retirement, Mitchell is looking forward to lowering his already enviable golf handicap, spending more time with family, and exploring the world alongside his wife. In between travelling and lowering his golf handicap, Mitchell will continue to keep a close eye on our future business endeavours.

Following Mitchell’s departure, Dane Parsons, Internal Audit Manager, will take the lead in delivering all internal audit and assurance engagements. Dane will be supported by Director Tony Harb, who will remain closely connected with the team as they continue to deliver the high standard of service our clients know and trust.

Mitchell, thank you for your exceptional leadership, dedication, loyalty and friendship over the past 17 years. Your contribution to InConsult, internal audit and to the wider public sector has been profound – and your legacy will continue to shape our journey.

Wishing you calm waters, smooth fairways, and many unforgettable adventures ahead.

With the ever-evolving digital landscape that now includes Artificial Intelligence (AI), cybersecurity threats are becoming more sophisticated, targeting individuals and businesses alike. It’s crucial to recognise the role we all play in securing the digital world, from using strong passwords to implementing comprehensive security measures in organizations.

The Australian Cyber Security Centre (ACSC) leads the Australian Government’s efforts to improve cyber security.

The theme for 2024 is ‘Cyber security is everyone’s business’.  There are 4 simple steps you can take to be cyber wise and significantly boost your cyber security:

1. Turn on multi-factor authentication – Multi-factor authentication (MFA) is one of the best ways to protect your accounts.
2. Keep your devices and software up to date – Check that automatic updates are on and install updates as soon as possible.
3. Use strong and unique passwords, such as a passphrase – Passphrases are more secure versions of passwords, using 4 or more random words.  Consider storing your passwords and passphrases in a reputable password manager.
4. Recognise and report phishing – Visit the ACSC Emails and texts information page for more details on how to identify and report phishing attempts.

Find out more about Cyber Security Awareness Month 2024 by visiting the Australian Cyber Security Centre website.

10 Ways to Promote Cyber Security Awareness

Don’t miss this opportunity to reinforce the importance of cyber security within your organisation. What will you do to raise awareness that cyber security is everyone’s business?

Here is our list of 10 things you can do during Cyber Security Awareness Month:

1. Plan ahead. Work with your People & Culture, Risk Management and Communication teams in a rollout plan to engage and reach as many employees as possible.
2. Set the ‘tone from the top’ by creating a culture of cyber security awareness. The entire C-suite needs to understand and embrace cybersecurity efforts.  Cyber security habits are best learned through management taking the lead.
3. Review your cyber security touchpoints.  Is cyber security awareness part of onboarding? How often does your organisation communicate about cyber security? Which vendors pose the highest cyber risk for your organisation?
4. Arrange cyber security awareness training sessions. Awareness training should reinforce that cyber security is everyone’s business and stress the importance of cyber security at work and at home.
5. Run a simulated phishing campaign to evaluate employee behaviour on receipt of a socially engineered phishing email, analyse results and provide a report of the results to all staff.
6. Review and update key elements of your IT-Disaster Recovery Plan or Data Breach Incident Response Plan.
7. With cyber attacks and third party data breaches on the rise, conduct a Crisis Management Team simulation exercise covering one of these risks.
8. Provide management a high level presentation covering the concept of operation of the Data Breach Incident Response Plan.
9. Run on-line games and quizzes such as crosswords and find a word with cybersecurity words as the central theme.
10. Reward good behaviour and people who embrace cyber security. Rewards don’t have to be expensive – small gift vouchers are often enough and always appreciated.

Want to Strengthen Cyber Resilience?

InConsult is an ACSC partner and we strongly encourage all organisations to get involved in Cyber Security Awareness Month. Contact us if you would like help in planning or conducting cyber awareness training or email phishing campaigns.

Remember that whatever you do, it’s all about keeping cyber security front of mind! Check out InConsult’s Cyber Resilience capabilities to find out how we can help you build a more resilient organisation.

Be more resilient to a wide range of cyber risks and contact us to discuss how we can help strengthen your cyber security posture.

#staysecureonline #CyberSecurityAwarenessMonth2024

Cyber attacks are still on the rise and your employees and vendors are more susceptible than ever to attacks like phishing and social engineering. Cybercriminals are constantly developing more sophisticated and targeted tactics to exploit both people and vulnerabilities.

According to the ACSC, one cybercrime is reported every 7 minutes.

In Australia, October is Cyber Security Awareness Month and it’s an annual reminder for all Australian’s to stay secure online.  The Australian Cyber Security Centre (ACSC) leads the Australian Government’s efforts to improve cyber security.

The theme for 2023 is ‘Be cyber wise – don’t compromise’.  There are 4 simple steps you can take to be cyber wise and significantly boost your cyber security:

1. Update your devices regularly
2. Turn on multi-factor authentication
3. Back up your important files
4. Use passphrases and password managers

Meanwhile, in the United States, October is also Cyber Security Awareness Month.  The event runs all month and aims to raise awareness about the importance of cybersecurity. 2023 marks 20 Years of Cybersecurity Awareness Month.  Cybersecurity Awareness Month 2023 will focus on four key behaviours all month long:

1. Use strong passwords and a password manager
2. Turn on multifactor authentication
3. Recognize and report phishing
4. Update software

Find out more about Cyber Security Awareness Month 2023 by visiting the Australian Cyber Security Centre and the National Cyber Security Alliance websites.

10 Ways to Promote Cyber Security Awareness

Don’t miss this opportunity to reinforce the importance of cyber security within your organisation. What will you do to raise awareness and encourage people to #BeCyberWise?

Here is our list of 10 things you can do during Cyber Security Awareness Month:

1. Plan ahead. Work with your Human Resources, Risk Management and Communication teams in a rollout plan to engage and reach as many employees as possible.
2. Set the ‘tone from the top’ by creating a culture of cyber security awareness. The entire C-suite needs to understand and embrace cybersecurity efforts.  Cyber security habits are best learned through management taking the lead.
3. Review or audit your cyber security touchpoints.  Is cyber security awareness part of onboarding? How often does your organisation communicate about cyber security? Which vendors pose the highest cyber risk for your organisation?
4. During the pandemic, many employees may still be working from home.  Conduct on-line cyber security awareness training sessions. Awareness training should reinforce that it is everyone’s role to #BeCyberWise and stress the importance of cyber security at work and at home.
5. Run a simulated phishing campaign to evaluate employee behaviour on receipt of a socially engineered phishing email, analyse results and provide a report of the results to all staff.
6. Review and update key elements of your IT-Disaster Recovery Plan or Data Breach Incident Response Plan.
7. With cyber attacks and third party data breaches on the rise, conduct a Crisis Management Team simulation exercise covering one of these risks.
8. Provide management a high level presentation covering the concept of operation of the Data Breach Incident Response Plan.
9. Run on-line games and quizzes such as crosswords and find a word with cybersecurity words as the central theme.
10. Reward good behaviour and people who embrace cyber security. Rewards don’t have to be expensive – small gift vouchers are often enough and always appreciated.

Want to Strengthen Cyber Resilience?

InConsult is an ACSC partner and we strongly encourage all organisations to get involved in Cyber Security Awareness Month. Contact us if you would like help in planning or conducting cyber awareness training or email phishing campaigns.

Remember that whatever you do, it’s all about keeping cyber security front of mind! Check out InConsult’s Cyber Resilience capabilities to find out how we can help you build a more resilient organisation.  Our cyber risk management services include:

• Gap Analysis of your Cyber Security and Resilience
• Cyber Risk Governance Framework Review
• Cyber Risk Governance Framework Development
• Third-Party Vendor Review and Cyber Risk Analysis
• Cyber Risk Awareness Training and Internal Campaigns
• Email Phishing Campaigns
• Cyber Incident Response
• Post-Cyber Incident Review
• Crisis Team Familiarisation Training

Be more resilient to a wide range of cyber risks and contact us to discuss how we can help strengthen your cyber security posture.

#staysecureonline #becyberwise #CyberSecurityAwarenessMonth2023

The group of 20 peak bodies include the Insurance Council of Australia, Financial Services Council, Australian Banking Association, the Australian Council of Superannuation Investors, CPA Australia, Chartered Accountants Australia and New Zealand and the Institute of Public Accountants.

Collectively the group represent more than 400 companies, approximately 300 investors with US$33 trillion assets under management and 500,000 business and finance professionals.

The group welcomed the new International Sustainability Standards Board (ISSB) draft sustainability standards published in March 2022.  The group believes that clear, transparent, comprehensive and comparable disclosure of sustainability-related information to be part of the foundations of a well-functioning global financial system.

The group also recognised that climate is a “first order risk” to the Australian economy and stated that it supported the Paris Agreement and its objective to achieve net-zero emissions.

The only caveat…the group said the transition to achieving a net-zero emissions economy needed to be undertaken with care.  The group said, “To avoid large-scale financial risks from a disorderly transition to net zero emissions and the physical impacts of climate change, there must be clear and comparable disclosure of sustainability-related and in particular, climate-related information.”

The ISSB Will Lead Sustainability & Climate Reporting

The ISSB released two exposure drafts in March 2022.  They set out general sustainability-related disclosure requirements and specified climate-related disclosure requirements while also providing stakeholders with the opportunity to comment on the proposed standards.

Just days earlier, the effort to establish a global baseline for sustainability disclosures took another positive step with the consolidation of the Value Reporting Foundation (VRF) into the IFRS Foundation.

The IFRS Foundation is home of  both the ISSB and the International Accounting Standards Board (IASB), the global standard-setter for financial reporting.

In recent years, investors with global investment portfolios have been calling for more transparent environmental, social and governance (ESG) reporting by companies.  The ISSB was launched by the IFRS Foundation at last year’s COP26 summit and was tasked with developing a single set of standards to meet the information needs of investors.

In March 2022, the U.S. Securities and Exchange Commission’s (SEC) proposal on thorough environmental reporting by American public companies also came in response to a shift in investor interest and public opinion.

Sustainability & Climate Reporting Next steps

The agreement provides the foundations for taking further steps towards sustainability and climate reporting reporting. Moving forward:

• There will be a global approach to the development of sustainability disclosure standards.  The coordinated approach helps ensure there is no regulatory fragmentation in definitions, terminologies, and metrics on disclosure.
• The ISSB will be the global body overseeing these standards.
• There will be collaboration and coordination between sustainability disclosure initiatives and financial accounting standard setting.
• The goal will be to achieve a globally consistent and verifiable corporate reporting system.
• The new disclosure standards will impact Australia’s capital markets and participants, as investors continue to demand comparable disclosures.
• The 20 peak bodies will work with the Australian government as well as other national and international stakeholders.
• The assurance providers including Registered Company Auditors, will need to expand their skill set in order to keep up with a fluid environment.

The agreed approach now provides the foundations for taking steps towards sustainability and climate reporting reporting.

Financial institutions like banks and insurers and well as listed companies will need to stay vigilant and engage with their peak bodies.  Also, risk, investment, finance, audit and assurance professionals will need to stay ahead of developments and keep their skill set up to date.

The Challenges

Recently, 86 finance chiefs from across the globe signed a letter sent to the ISSB insisting on the improvement of its proposed reporting standards in 6 areas:

1. Alignment with relevant existing sustainability reporting standards “to the greatest extent possible.”
2. Clarity on what constitutes enterprise value, recognizing that investors may need disclosures on broader social and environmental impacts to assess risk and make investment decisions.
3. Clear definitions and guidelines for preparers.
4. Disclosure requirements should enable a “continued focus on setting science-based, ambitious targets and the actions needed to achieve them.”
5. Promote integrated thinking through frameworks such as the Integrated Reporting Framework.
6. Address the environmental, social, and economic issues that impact decision-making.

The Benefits

More than 80% of mainstream investors now consider ESG information when making investment decisions. There are currently $23 trillion of assets being professionally managed under responsible investment strategies, an increase of 25% since 2014 which exceeds the gross domestic product of the entire USA economy.

Besides the clear benefits to the environment and reducing the financial impact of climate change, improved guidance will reduce the risk of ‘greenwashing’.  This is when an organisation spends more time and money on marketing itself as sustainable and environmentally friendly than on actually minimizing its environmental impact.  We saw this when Volkswagen admitted to cheating emissions tests by fitting various vehicles with a “defect” device, with software that could detect when it was undergoing an emissions test and altering the performance to reduce the emissions level.

12 ESG Questions

Achieving the desired ESG posture is not easy and there are lots of questions the board can ask.  Here are 12 questions to start:

• Does the organisation’s vision and values specifically reflect a commitment to ESG?
• Is the board approved ESG policy and framework aligned to the organisations vision and values?
• Are ESG responsibilities clearly described and included in positions descriptions and performance incentives?
• Is ESG on the board and leadership agenda?
• Has the organisation identified the ESG related compliance obligations and assigned responsibilities to monitor?
• Has the organisation identified the ESG related risks and developed the appropriate action plans?
• Are ESG practices embedded into day-to-day business processes and activities?
• Does your ESG framework extend to third parties, vendors and suppliers?
• Is there regular communication between your organisation and stakeholders?
• Is there regular reporting and monitoring of your ESG posture to the board?
• Are the underlying assumptions in the analysis reasonable and supported by evidence?
• Does internal audit verify the accuracy and completeness of ESG reporting processes, external disclosure and data?

There is no right or wrong here, but your answer should be appropriate to your organisation, industry and stakeholder expectations.

Remember, climate change financial risks are often categorised into physical, transition and legal/ liability risks and they all must be managed.

Next steps

What does this agreed way forward mean to your business? What does sustainability look like at your organisation? How far do you want to go to minimise the impact of climate change on your business?

Whatever your climate resilience posture, making a start as soon as possible is better than waiting to get it perfect or waiting until you have researched all the alternatives.

There are four ways that we can help you with your environmental and sustainability reporting:

1. Interpreting applicable standards and frameworks and advising you on their benefits and application.
2. Environmental/sustainability performance reporting obligation compliance.
3. Understanding the best metrics and data to record and report.
4. Generating your reports.

Be more resilient and contact us if you would like help with developing sustainability strategies, climate change risk assessments and testing, sustainability education and reporting.

Based within the Australian Signals Directorate (ASD), the ACSC constantly monitors cyber security threats 24 hours a day, seven days a week from a range of local and global sources, including through government and business computer emergency response teams (CERTs) around the world.  The ACSC then provides advice and information about how to protect organisations from these threats.

What an ACSC Partner means for our clients

InConsult is one of the largest risk management, resilience and internal audit service providers to local government, financial services and the not-for-profit sectors.  These sectors can be vulnerable to cyber attacks and cyber crime.

Threat Intelligence

Although we cannot always share all the information we are privileged to, being an ACSC partner allows us to be at the forefront of any alerts and advisories on the current cyber threat landscape.  We will also have access to a wide range of technical information and mitigation strategies.

Collaboration

InConsult can also participate in special briefings, workshops, events and cyber security exercises.  We can draw on the collective understanding, experience, skills, and capability to lift cyber resilience across the Australian economy.

Resource sharing

The ACSC has also developed a range of cyber security campaign resources which can be shared. These resources including social media banners and tiles, posters, flyers, guides and checklists.  These resources help to educate Australians about cyber threats and provide easy-to-follow cyber security advice.

We also recommend our clients join the ACSC partner program to help them strengthen their cyber resilience.

William Makdessi, Cyber Lead at InConsult said, “As a proud ACSC partner, we now have access to the Australian Cyber Threat Intelligence Sharing (CTIS) network. This new method of intelligence sharing ensures threats in the Australian landscape are processed and shared faster than ever before.”

How we can help you be more cyber resilient

We are here to help strengthen cyber resilience. Our cyber resilience capabilities include designing and developing a cyber risk management framework and a wide range of response plans to enhance your cyber resilience capabilities. Our cyber resilience services include:

• Gap Analysis of your Cyber Security and Resilience 
• Cyber Risk Governance Framework Review
• Cyber Risk Governance Framework Development
• Third-Party Vendor Review and Cyber Risk Analysis
• Cyber Risk Awareness Training and Internal Campaigns
• Email Phishing Campaigns
• Cyber Incident Response
• Post-Cyber Incident Review
• Crisis Team Familiarisation Training

Be more resilient to a wide range of cyber risks and contact us to discuss how we can help strengthen your cyber resilience framework.

Background

For NSW councils, the audit program is closely aligned with the Report on Local Government 2020 released in May 2021 where there were 1,435 findings reported to councils in audit management letters. The report also identified:

• One extreme risk finding relating to Central Coast Council’s use of restricted funds for general purposes
• Fifty-three high risk matters were identified across all councils: 
  • 21 high risk matters relating to asset management
  • 14 high risk matters relating to information technology
  • 7 high risk matters relating to financial reporting
  • 4 high risk matters to council governance procedures
  • 3 high risk matters relating to financial accounting
  • 3 high risk matters relating to purchasing and payables
  • 1 high risk matter relating to cash and banking

Source: Audit Office of NSW – Report on Local Government 2020

With around 100 local council clients, InConsult is one of the largest and most respected risk, resilience and internal audit service provider to NSW local councils. We reviewed the 41 page work program and summarised the planned audits that directly and indirectly impact local councils over the next few years along with some suggested next steps to help you stay ahead.  

Audit program 2021-24

The 3 year audit program will not necessarily include every one of the 128 local councils and 10 county councils. The results of each performance audit will be reported to the local council concerned, the responsible minister, the Secretary of the Department of Planning, Industry and Environment, and Parliament.  Local council’s who are not subject to the performance audit should reflect on the reported findings when available and re-evaluate their own internal control environment.

It is not surprising that the 2021-24 audit program is closely aligned to the high risk areas the Auditor-General is concerned about. 

1. Cyber security

This is no surprise. Cyber risk is amongst the top 5 risks for most organisations and the increasing frequency and intensity of attacks is a concern. Such incidents can harm local government service delivery and may include the theft of information, denial of access to critical technology, or even the hijacking of systems for profit or malicious intent.

When cyber security risk management is done well, it reinforces organisational resilience, making entities aware of their risks and helps them make informed decisions in managing those risks.

Cyber Security NSW first released the NSW Cyber Security Policy in 2019 following the Audit Office’s sector-wide performance audit ‘Detecting and responding to cyber security incidents’. The policy outlines the mandatory requirements to which all NSW government departments and Public Service agencies must adhere, to ensure cyber security risks to their information and systems are appropriately managed.

The audit will consider how well selected councils ensure they have effective cyber security measures in place.  In preparation, read more about our framework to help you achieve cyber resilience.

2. Strategic property portfolio management

This audit will be a whole-of-government/multi-agency performance audit. Whilst not specific to only local councils, the effectiveness of strategic property portfolio management, and the integrity of processes and outcomes for property acquisitions and disposals will be under the microscope.  

3. Effectiveness of financial management and governance in selected council(s)

Financial sustainability is still an issue for many NSW Councils and the serious financial situation at Central Coast Council has further highlighted gaps and risks in respect to financial management and governance.

In our recent publication, Most Common Control Weaknesses in Local Government, we identified 4 areas in financial management that need attention.

• Procurement
• Development Assessment
• Accounts Payable
• Accounts Receivable/Debt Recovery

The audit will examine how these principles are effectively applied in the councils’ financial and asset management, funding decisions and risk management practices.  It may also examine how councils’ expenditure and investment decisions have complied with the Act.

4. Development assessment process in local councils: Assessment stage

The DA and construction approval process has six stages – pre-lodgement, lodgement, assessment, determination, post decision and occupation certificate, and there are a number of participants who have involvement across those stages.

In 2018–19, the Auditor-General completed an audit that focused on the ‘pre-lodgement’ and ‘lodgement’ stages of the development assessment process at two local councils.

The next planned audit could assess the extent to which the ‘assessment’ stage at selected local councils aligns with relevant legislation and relevant guidance from the NSW Department of Planning, Industry and Environment (DPIE) and the Independent Commission Against Corruption (ICAC).

5. Coastal management (selected coastal councils)

The Coastal Management Act 2016 and the State Environmental Planning Policy (Coastal Management) 2018 guide and inform coastal management programs.  The performance audit could assess how effectively the Planning, Industry and Environment cluster has overseen and implemented key elements of this reform package, and how effectively coastal councils have delivered coastal management programs.

6. Road asset maintenance

Local councils help maintain over 144,000 km of roads across their networks. Roads and related assets (eg bridges and footpaths) are material and make up more than $57.5 billion or 54% of Council Assets. This audit will have a focus on regional roads and will build on lessons learned in the Audit Office’s 2014 audit on Regional Road Funding and the 2018 audit on Road Maintenance Contracts. The audit may consider how effectively and efficiently local councils plan for, and manage, their road assets including maintenance activities, rehabilitation and rebuilding roads at the end of their useful life.

7. Council amalgamations

A number of council amalgamations took place in 2016 and the NSW Government projected $2 billion of benefits would be realised over a 20-year period.

The council amalgamation audit will assess whether the NSW Government effectively planned for the amalgamations process, including whether advice supporting the decision to implement amalgamations was based on robust analysis and enabled an assessment of progress in achieving clearly-defined, long-term benefits.

8. Building regulation – responding to combustible external cladding

Whilst the Department of Customer Service cluster undertakes regulatory and compliance activities, local councils have a role to play in enforcement.  Following fires at the Lacrosse Building in Melbourne in 2014 and the Grenfell Tower in London in 2017, the NSW Government began implementing a coordinated, whole-of-government policy response to the fire safety risks posed by combustible external cladding.

This audit may examine how effectively the Department of Customer Service, Department of Planning and Environment, Fire and Rescue NSW, and local councils are implementing the NSW Government’s fire safety reforms, including to:

• identify and remediate existing risks from the use of external cladding
• prevent the future use of unsafe external cladding

 9. ePlanning portal

All councils were required to commence using the NSW Planning ePlanning portal from 1 January 2021 and to process 100 per cent of planning applications using the portal from 1 July 2021.  The audit will focus on whether the ePlanning program has realised its intended benefits related to efficiency, transparency and collaboration and whether the rollout process to councils has been implemented in a successful and timely way.

10. Precinct planning (selected local councils)

This audit will consider how effectively the Office of Local Government coordinates other responsible government entities to deliver ‘a planned approach to growth in Sydney, with new homes and jobs located close to public transport, shops and services, while retaining and enhancing a community’s character’.

11. State infrastructure contributions and voluntary planning agreements

Recent audits of local infrastructure contributions collected and spent by local councils found that increasing balances were present in councils that did not have strong governance over the funds. The audit will examine governance over these contributions and transparency over how contributions are levied and spent.  It is not clear if some local councils will be impacted, but we recommend all councils review their infrastructure contributions and voluntary planning agreements.

12. Managing the code of conduct

The Office of Local Government (OLG) released a model code of conduct for council officials covering bullying and harassment, pecuniary interests and managing conflicts of interest. This audit could look at the compliance of councils’ codes of conduct against the model code, the effectiveness of their implementation and the effectiveness of complaint handling. It could focus on one or more of the issues covered by the code including bullying and harassment, managing conflicts of interest and disclosure of pecuniary interests. It could also consider the OLG’s role to provide oversight, right of review and support functions under the model code.

13. Performance management and monitoring

All local councils should have adopted the Integrated Planning & Reporting (IP&R) framework by June 2012. The IP&R ensures councils’ delivery of programs and operational plans are aligned with community priorities. This audit could examine councils’ compliance with IP&R Guidelines and could also examine how the OLG has supported councils through the development of a performance measurement framework and delivered direct support to rural councils. This audit would follow on from the Audit Office’s 2018 performance audit which reviewed the annual reports of all local councils to look at the performance of a select number of councils in depth.

That’s NOT all folks!

A final note, the Auditor-General conducts financial and performance audits, principally under the Government Sector Audit Act 1983 (GSA Act) and the Local Government Act 1993 (LG Act). The Auditor-General also has the power to examine allegations of serious and substantial waste of public money under the Public Interest Disclosures Act 1994.  From time to time, the Auditor-General receives and responds to specific requests for special reviews or emerging issues of significant public interest in the areas of governance, misconduct, compliance or service delivery.  The 2021-24 audit program can change anytime based on incidents and emerging risks.

Next Steps

Be proactive  

Will your council be selected for one of these performance audits?

At minimum, we recommend all governance, risk and internal audit professionals in NSW local government at least consider these areas and assess how their council is positioned.  As yourself:

• Were these areas covered in the internal audit program in the last 2 years?
• Has there been any recent incidents in these areas that suggest control weaknesses?
• Has there been a change is policies, processes, systems or people in these areas?
• Have council officer or risk owners recently reviewed their risks and controls?

Learn from the audit findings  

It’s said that a wise person learns from their mistakes, but a wiser person learns from others’ mistakes – or in this case, the audit findings from the local councils that were audited. 

Council’s who are not subject to the performance audit should reflect on the reported findings when available and re-evaluate their council’s risk exposure, governance arrangements and internal control environment.

Get in touch

From one-off internal audits to a three year audit program, and from Sydney metropolitan to regional councils, we tailor our internal audit services to suit your needs, size, maturity and budget.  

Learn more about our Internal Audit and Assurance Services and the result of the Internal Audit Quality Assessment performed by the Institute of Internal Auditors Australia. Our clients can be reassured that our internal audit approach and methodology is second to none.

InConsult is also prequalified under NSW Local Government Procurement Internal Audit and Management Consulting Panel LGP218. 

We help you confidently take risks, strengthen resilience and stay in control.  If you would like to discuss your audit needs, please contact us.

Whilst we believe we have high standards internally, we wanted to know what would an external, objective and independent review say about the quality of our internal audit services we provide to our clients.

In November 2020, InConsult engaged the Institute of Internal Auditors Australia to conduct an External Quality Assessment of our internal audit services to assess InConsult’s conformance with applicable mandatory requirements of the ‘International Professional Practices Framework’ (IPPF) issued by the Institute of Internal Auditors (IIA), including the ‘International Standards for the Professional Practice of Internal Auditing’.

We are delighted to advise that InConsult achieved the highest rating possible of “Generally Conforms”.  The review concluded that:

“Internal audit services provided by InConsult to their clients are performed professionally and generally conform with the Internal Audit Standards; this is the highest rating that can be achieved. Client organisations value internal audit services provided by InConsult. InConsult consultants performing internal audit services are experienced and competent professionals.
Client stakeholders interviewed as part of the Quality Assessment expressed satisfaction with the internal audit services provided by InConsult.”

THE APPROACH

Standard 1312 states that External Quality Assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organisation.  

The methodology used for the Quality Assessment involved a full scope assessment against the Internal Audit Standards performed by an assessment team from the IIA–Australia. This methodology is promoted by the IIA internationally.  The scope of the independent audit review encompassed:

• Reviewing documentation.
• Reviewing selected internal audit engagement work papers.
• Performing limited testing to form an opinion on conformance to the Internal Audit Standards.
• Conducting confirmatory interviews with our clients and stakeholders.
• Reporting results.

OUR CURRENT STATE

The review confirmed the following:

• Internal audit services are well-managed.
• There is focus on internal audit quality with some opportunity for enhancement.
• A sound risk-based approach is adopted for internal audit planning
• There is a fit-for-purpose approach to planning and performing internal audit engagements
• There is a sound internal audit reporting approach
• Clients commented positively about InConsult relations with stakeholders.
• There are solid internal audit foundations in place.
• There is strong engagement with clients.

In terms of internal audit maturity, we scored very high – predominantly in the ‘Managed’ and ‘Optimising’ levels.

WHAT DOES THIS QUALITY ASSESSMENT MEAN FOR OUR CLIENTS?

Our clients can be reassured that InConsult is committed to quality and continuous improvement and that our internal audit activities are conducted in accordance with the International Standards for the Professional Practice of Internal Auditing​ (Standards).

From one-off audits to a three year audit program, we will tailor our internal audit services to suit your needs, size of your organisation and your budget.  

Learn more about our Internal Audit and Assurance Services. We look forward to supporting our clients to help them take and manage risks with confidence.