Internal audit should be seen a valuable aid to managers, not just a check on their probity. A progressive internal audit function will welcome opportunities to help improve how things are set up, rather than simply judging any inadequacies 'after the event'. Such broad involvement ought to help both managers and auditors, who are then better linked to the change issues which matter to the organisation and major areas of risk. NHS bodies all have a duty to secure adequate internal audit coverage which follows PSIAS, the volume of which is determined by their audit committee and board and, to a limited extent, the requirement to support external audit. Having set that level, it makes sense for economy and effectiveness alike to use internal auditors to carry out consultancy work, the more so if they can substitute for external resource.
In order to understand the current position we felt it was important to have a baseline understanding of the service provision and usage. We began by surveying NHS provider organisations, asking the following questions:
Of the 233 provider organisations in England, 34 completed full responses within the timescale, providing a reasonable sample of 15%. A number of additional responses were also received from Wales and Scotland.
Size of IA provision
The size of internal audit provision has been judged based on the number of days contracted. To take account of organisational scale and complexity, this has been looked at per £m turnover. It is acknowledged that there is an element of ‘overhead’ involved regardless of organisational size, however this has not been adjusted for due to differences of opinion regarding the size of this central resource.
There is a wide range of internal audit usage across the organisations:
Lowest - 0.4 days per £m turnover.
Highest – 3.1 days per £m turnover.
Average – 1.04 days per £m turnover.
Costs also vary significantly therefore a larger number of days doesn’t necessarily relate to a higher overall cost. From 2015/16 NHS providers have (in the main) included the costs of internal audit in their annual accounts. Comparison of the 2015/16 reported costs with the number of days contracted suggests daily rates vary significantly between approximately £300 and £700 per day with an average of approximately £450.
Type of IA provider
Traditionally, most NHS provider organisations employed their own internal auditors either as a standalone organisation or more commonly across a former health authority area. Many of these former internal providers have merged to form consortia – some of which are hosted by NHS bodies (in house consortia) whilst others have formed their own standalone organisations (standalone consortia). Accountancy and audit firms also provide internal audit services. The graph below shows the breakdown between these three categories across the organisations completing the survey:
There is no clear pattern in the number of days or cost per day for the three groups, although general themes emerge. In house consortia tend to have the lowest cost per day and the highest number of days, vice versa for provision by firms with standalone consortia lying between the two.
Differences between nations in the UK
The survey was originally sent out to health providers in England, however following prompts in our Health and Integration newsletter we received a number of submissions from Scotland and a few from Wales, which were much appreciated. These revealed some interesting differences: due to the health board structure which does not have the commissioner provider split, health bodies in Scotland are much larger than those in England and although their internal audit provision is large, relative to the size of the budget is generally lower – as low as 0.2 days per £m for one of the larger health boards. Counter fraud is also commissioned centrally in Scotland, rather than being sourced and managed at individual organisational level. These differences raise interesting questions of cost effectiveness, which could be considered in the emerging Sustainability and Transformation Plans (STPs) and Accountable Care Organisations (ACOs) in England.
Use of internal audit for transformation and improving efficiency
The answers to this element tended to be fairly brief, most of which did not identify any particular examples – one trust answered ‘not hired to identify these savings’. Some however did provide examples:
- benchmarking (three)
- value for money work
- process redesign on medical equipment
- improvements to processes such as stocktakes and payroll
- job planning which has improved efficiency
- audit of design and implementation of CIPs/CIP PMO (two)
- benefits realisation of EPR (electronic patient record) implementation
- capital prioritisation
- outpatients – improving patient flow and bookings
- reviewing and learning from best practice elsewhere.
Opportunities for future use of internal audit
- Identifying and sharing good/best practice (nine), including from social care and the private sector.
- Applying leverage across health and social care services.
- Benchmarking (eight).
- More specialist work in particular areas (not specified which).
- Updates on national initiatives eg apprenticeships.
- Targeted reviews on areas to look at cost effectiveness.
- Investment in prevention approaches.
- Supporting Carter programme.
- Providing contacts for best practice.
- Working across an entire STP.
Other suggestions for improving internal audit
- Work more closely with service management.
- Vary audits from year to year to reduce complacency.
- Should do more project assurance.
Next steps
This initial research suggests that there are significant differences between trusts in the extent of and type of use of internal audit. Inclusion of the costs of internal audit, alongside external audit and consultancy in the accounts will allow a greater degree of comparison which will shape our thinking in this area.
We are establishing a Special Interest Group to look further at the role of internal audit as well as CIPFA’s role in supporting the internal audit community across the public sector. It will also help to shape CIPFA’s thought leadership on internal audit.
If you are interested in taking part in this, or would like to share your thoughts and comments on this topic please contact E: customerservices@cipfa.org
Discover more:
Find out more about CIPFA's Internal Audit Services: