Part 3: The audit committee and internal review
The need for colleges to establish processes to ensure systems are effective and compliant.
3.1. The college must establish an audit committee, appointed by the board, to provide independent assurance to the board that its financial and non-financial controls are operating effectively. The role and responsibilities of the committee are detailed in part 2 of the Post-16 audit code of practice (P16ACOP). It must:
- oversee the college’s programme of internal review
- ensure that risks are being addressed appropriately
- report to the board on the adequacy of the college’s internal control framework, including financial and non-financial controls and risk management
- provide the Education and Skills Funding Agency (ESFA) with an annual report on its activities
3.2. The committee must:
- have written terms of reference
- agree an annual programme of work
- review the ratings and responses on the risk register to inform the programme of work
- agree who will perform the work
- consider reports at each meeting from those carrying out the programme of internal review
- consider progress in addressing recommendations
- consider outputs from other assurance activities by third parties including funding audits and investigations
- have access to the external auditor, as well as those carrying out internal review, evaluate their plans and reports and also consider their quality
3.3. The committee’s oversight must extend to the financial and non-financial controls and risks at all constituent colleges, subsidiary companies and any subcontractors (where relevant). This includes controls relating to learner data and funding claims. It must also ensure that all recommendations arising both from the programme of internal review or from external audit are followed up effectively.
3.4. In accordance with the College accounts direction (CAD) and the Post-16 audit code of practice (P16ACOP), the committee must produce an annual report for the board and accounting officer, summarising the committee’s activities relating to the financial year under review, including the issues set out in the CAD.
3.5. The annual report to the board must be submitted to the board before the statement of corporate governance and internal control in the annual accounts is signed.
3.6. The committee must also provide a statement which draws upon that annual report, and where appropriate, the work of internal review, and submit it to ESFA with the college’s audited annual report and accounts. The statement should include an opinion on the effectiveness of the college’s framework of internal control.
3.7. Colleges must have a process in place to deliver a programme of internal review to enable the audit committee to discharge its responsibilities, but there is flexibility for colleges regarding how this is delivered. Although colleges are not required to commission internal auditors, having an internal audit service, which may be supplemented by specialists in particular areas, will assist audit committees in ensuring they have effectively discharged the requirements set out in the Post-16 audit code of practice (P16ACOP).
3.8. When a college has chosen not to appoint internal auditors, the audit committee must explain in its annual report to ESFA how it has discharged its responsibilities to oversee a programme of internal review and obtain the necessary assurances concerning internal control and risk. If internal auditors have been appointed, then they should be members of a relevant professional body.
3.9. Colleges should note that the Financial Reporting Council’s Ethical Standard states that a firm providing external audit to an entity shall not also provide internal audit services to it.
ESFA has published a guide on the scope of work of audit committees and internal auditors in college corporations.
Further information on internal audit is available: