Report Summary
This report provides members of the Scottish Police Authority's Audit, Risk & Assurance Committee with an overview of BDO’s Internal Audit progress. This also includes Q2 Follow Up review results.
To access the full document please open the PDF document above.
To view as accessible content please use the sections below. (Note that tables and some appendixes are not available as accessible content).
Meeting
The publication discussed was referenced in the meeting below
Audit, Risk and Assurance Committee - 12 November 2025
Date : 12 November 2025
Location : online
Report detail
This Internal Audit progress report provides an update on audit work completed between August and October 2025.
The Q2 Follow-up results cover the implementation status of all recommendations raised from the work carried out by Internal Audit which were due to be implemented by 30 September 2025 (Q2).
Appendix A Internal audit progress update
The report provides an update on the status of each of the 13 scheduled audits within the 2025/26 plan.
• Two audits have been completed and were presented to ARAC in August.
• Three audits are ‘final’ and are being reported to ARAC at agenda item 3.1.
• One audit (change) is “reporting” and will be presented to ARAC in February.
• Four audits are “in progress” with fieldwork underway.
• The audits for IT Systems and Productions are at “planning” and “scheduled” respectively.
• Following engagement between SPA, Police Scotland and BDO it was concluded that the Communications and Engagement audit should be deferred. Since the internal audit plan was drafted, Police Scotland Corporate Communications has begun the process of implementing a new approach to the delivery of internal communication. This has been developed in conjunction with and validated by external subject matter experts. Reflecting this new approach, supported by external experts, it was concluded that deferral was appropriate. SPA/PS and BDO are considering options, including an alternative audit or no replacement audit, in the current financial year.
Eleven internal audit KPI’s are outlined in the report.
• Ten KPI’s are ‘on track’ / “green”.
• One KPI is “grey” which indicates these are ‘not yet started’, which is appropriate as this is linked to the production of the annual internal audit report/ opinion which is not due till May 2026 ARAC.
Appendix B – Q2 Management action follow-up
Appendix B summarises the progress made by Police Scotland, Forensic Services and SPA in implementing previously agreed internal audit actions. Internal audit validate the closure of actions with targeted timeline in Q2 2025/26.
Total 48 recommendations followed up in September 2025:
• 18 (38%) are fully implemented
• 29 (60%) remain in the process of being implemented
• 1 (2%) were not yet implemented
A PowerBI report giving full details of recommendations has been provided to ARAC members. This change supplements the summary being reported to the committee while also ensuring BDO comply with Global Internal Audit Standards in the UK Public Sector.