INTERNAL AUDIT SERVICES

Legislation is currently being considered by Parliament for the transfer of horse racing betting levy collection from The Horse Race Betting Levy Board to the Commission. This is an entirely new segment of operation and will involve the collection of circa £100m per annum from operators based in the UK and overseas. Strong systems of corporate governance are therefore vital. The provision of an independent, risk based internal audit service forms an essential part of these arrangements, and will be achieved through: • Agreeing an annual internal audit programme with the Accounting Officer, the Executive and Audit & Risk Committee that reflects areas of significant risk, and appropriate governance arrangements; • Undertaking reviews as per the agreed plan and reporting the results of each review to management and the Audit & Risk Committee. We would expect this plan to be proportionate, weighted towards operational audits that add value to the Commission, but with adequate focus on cyclical review of core controls to support the annual internal audit opinion. • Agreeing with management recommendations for improvement and an agreed action plan. • Providing examples of best practice and, where appropriate, benchmarking performance against other comparable organisations when providing reports to management and the Audit & Risk Committee. • Providing quarterly reports to the Audit & Risk Committee on progress against agreed audit plan. • Issuing an annual internal audit report and opinion on the adequacy of risk management, governance and internal control frameworks. A thorough review of these frameworks is underway, with a comprehensive risk, governance and internal control framework due to be established, in line with Managing Public Money, by the end of 2018/19. We would therefore expect internal audit focus and reliance to be placed on the adequacy of these internal control frameworks, rather than comprehensive testing of systems and documentation. • Attending all Audit & Risk Committee meetings to provide an overview of work performed to date, including details of any significant observations arising and an update on progress against audit plan. • Liaising with external auditors to ensure that NAO / KPMG are aware of significant findings from the internal audit programme. • Attending Audit & Risk Committee to provide independent assurance that risks are being considered. • Undertaking operational audits with the appropriate levels of specialist input to support report recommendations and observations. This could include (but not be restricted to) ICT/Digital/Cyber specialisms, forensic accounting, change/transformation advice and information management/security.

The internal audit services provider will also be required to carry out their work in accordance with: • Public Sector Internal Audit Standards. • FRC guidance for Boards and Board Committees.

The size and range of internal audit provision, along with the number of audit days re