Agenda item

Provision of Internal Audit Services (Contract for the supply of Internal Audit Services)

Meeting of Provision of Internal Audit Services (Contract for the supply of Internal Audit Services), Cabinet Member Signing, Monday, 7th September, 2026 11.30 am (Item 6.)

Decision:

DECLARATIONS OF INTEREST FOR THIS ITEM:

NONE

RESOLVED

For Cabinet Member to approve:

Under CSO 2.01b the commencement of a procurement process and the Council entering into an Access Agreement with Croydon Council, to call off services from their single-supplier Audit Services Framework Agreement, as permitted under CSO 7.02. This would mean an award to call-off contracts to Forvis Mazars Public Sector Internal Audit Ltd (Mazars) pursuant to CSO 2.01(c) to deliver the Internal Audit service for Haringey Council from 1 October 2026 for period of 3 years, 6 months to 31 March 2030 at a total cost of up to £2.0m over the duration of the contract, AND

Under CSO 2.01b the commencement of a procurement process and the Council entering into an Access Agreement with Barnet Council to call off services from their multi-supplier Internal Audit and Advisory Services (Cross Council Assurance Service) Framework Agreement as permitted under CSO 7.02 from 1 October 2026 to 31 March 2029 at a total cost of up to £1.5m over the duration of the contract.

To allow for an extension to the contract with Barnet Council for up to another 5 years to 31 March 2034. If this option was exercised the cost woud be an additional £2.5m, bringing the aggregated total value of the contract with Barnet to £4m for 8 year period.

The total cost for the provision of internal audit in any year would not exceed £0.5m allowing for any inflationary increases based on the 2026/27 tendered prices.

Reasons for decision

The current internal audit contract commenced on 1 April 2018 and expired on 31 March 2026 but which had been extended to 30 September 2026. Internal audit is a statutory function which Haringey Council is required to maintain. It is therefore necessary to ensure that an appropriate internal audit service is in place from 1 October 2026, to ensure ongoing compliance with statutory requirements as set out in options 4 and 5 at paragraphs 5.6 and 5.7 below.

Alternative options considered

Five options had been considered and these are set out below.

Option 1 – In House Service (Not Recommended)

Experience had proved that it was highly unlikely that an in-house resource could be recruited and retained to deliver the Council’s internal audit service in its entirety. Most London boroughs had outsourced their internal audit service to some extent and none were looking to bring this service fully back in-house due to the ongoing costs of recruitment, retention and specialist audit training required. Nevertheless, consideration would continue to be given for recruiting internal audit professionals to carry out elements of internal audit work and to compliment the use of the external internal audit provider. The consideration would look to actively test whether in-house model delivers greater long-term value with an assessment of business knowledge, cost scale and long term talent strategy. It was recognised an in-house service allows auditors to develop a deep understanding of Council processes, key relationships and understand the culture of the Council. The Chief Audit Executive (Head of Audit and Risk Management) was required by the Global Internal Audit Standards to carry out an annual review of the internal audit service, and as part of this process, the Head of Audit and Risk Management would consider the opportunity to recruit in-house internal audit professionals to deliver the internal audit plan.

Option 2 – Open Tender (Not Recommended)

The potential contract values involved for this length of contract would require a full re-tender following procurement legislation, under the Procurement Act 2023, unless an acceptable alternative procurement route is used e.g. an appropriate framework agreement. The full open tender approach by Haringey alone was not recommended as taking an independent procurement route in this way would be resource-intensive and unlikely to achieve better results in terms of value for money than the other exiting framework options available.

Option 3 – Crown Commercial Services (CCS) (Not Recommended)

This was a framework agreement established by central government for the provision of internal audit services under their Management Consultancy Framework. Although geared towards provision within Central Government, local authorities were included in the list of organisations eligible to use the framework. The framework included the provision of services from all the main providers of Local Government internal audit, namely: BDO LLP, Deloitte LLP, Ernst & Young LLP, Grant Thornton LLP, KPMG LLP, Mazars LLP, PWC LLP, and RSM Tax and Accounting PLC. 5.4.2 To utilise the framework it would be necessary to conduct a ‘mini competition’ between the contractors. While this option would ensure that the market is tested, it was considered that, as with the full tender (option 2 above), it was unlikely that the relatively small number of audit days Haringey would require would attract better rates than those available under the Croydon Council Framework. The current indicative standard daily rates quoted by each of the contractors within the overall government framework are higher than those currently paid by the Council under the Croydon Council Framework.

Option 4 – Shared Service with another local authority (Not Recommended)

A number of London boroughs have entered into shared service arrangements to deliver their statutory internal audit service in recent years. Some of these arrangements form part of large, shared arrangements covering a range of different council services, while others only cover internal audit arrangements. In the longer term, it might be beneficial for the Council to consider shared service arrangements if issues with the existing and contractual delivery of internal audit services are identified and this could result in a reduced cost to the Council. In such circumstances, shared service arrangements might provide:

· Improved resilience – less reliance on the external audit delivery partner to provide audit resources to the council;

· Access to specialist internal auditors – most councils would not have sufficient work to justify employing these to work solely at one authority;

· Contract options – explore alternative arrangements, including other frameworks, shared services etc.;

· Career opportunities – developing and retaining in-house audit staff to avoid reliance on external contractors; offering experience and training across one or more councils may attract higher calibre candidates;

· Savings opportunities – ongoing financial constraints mean councils look to review how services are delivered; exploring alternative arrangements may reduce overall costs across authorities.

A small number of the shared service arrangements have since reverted back to stand-alone internal audit services for their respective authorities; this has been for various reasons including: a recognition that the Head of the Shared Internal Audit Service has less capacity to support more than one authority; service delivery arrangements had not met expectations; and strategic arrangements had changed.

Nevertheless, there were a number of shared service models that had been in operation for a number of years and remain viable.

At a time when Haringey Council was undergoing significant financial and operational challenges, the level of risk exposure was increased and therefore it was critical that an adequate level of dedicated internal audit work was maintained to ensure new working systems and processes are implemented effectively across the organisation and relevant assurance is provided; and that sufficient senior level audit resources are available to support officers and members. This option may be considered in the future by the Head of Audit and Risk Management as part of the annual appraisal of the internal audit service.

Option 5 – Alternative Framework contract (Recommended)

There was an alternative framework agreement established by Barnet Council (Cross Council Assurance Service) that became available from 1 April 2026 for the provision of internal audit services and, other local authorities (including Haringey) were included in the list of organisations eligible to use the framework.

The framework was structured to allow local authorities to procure using a mini competition route of the three providers on the framework; KPMG, PWC and Forvis Mazars. For Haringey, as KPMG was the external auditor, and local authorities cannot have the same internal and external auditor for independence reasons, the authority would not be able to appoint KPMG as its internal auditor. The possibility of using PWC and Mazars from this framework remained available where economically advantageous or for the effective delivery of the internal audit function. The contract was structured as a call-off and, as such, offers Haringey Council maximum flexibility in terms of the number of days purchased in any year, with no requirement to purchase a minimum number of days. This option was included in the recommendations above to ensure all options remain available for the delivery of internal audit at the Council should specific requirements be needed and would add resilience for maintaining internal audit.

Option 6 – Croydon Council Framework Agreement (Recommended)

This option involved the Council using the framework agreement procured by Croydon Council. Croydon Council tendered for a single supplier framework agreement to take effect from 1 October 2026. The tender process was run as an open procedure (ref: 077840-2025). Croydon Council had confirmed that the framework agreement has been tendered in compliance with Procurement Regulations. Croydon Council’s framework agreement was delivered by a single supplier, Forvis Mazars Public Sector Audit Limited (Mazars), Haringey’s current supplier.

This was a shared services model, whereby Croydon Council was the contracting authority (and therefore the service provider) and would call off a contract on behalf of the authorities which participate in the framework agreement. The framework agreement was structured to provide better value for money for audit services as more authorities join the framework. The contract was structured as a call-off and, as such, offers Haringey Council maximum flexibility in terms of the number of days purchased in any year, with no requirement to purchase a minimum number of days.

To ensure the contractor delivered maximum value for money throughout the contract lifecycle, the Head of Audit and Risk Management would implement a robust ongoing monitoring and annual evaluation framework using internal audit’s Quality and Improvement Plan (QAIP). Service performance would be measured against clear key performance measures (KPIs), including plan delivery timelines, budget adherence, stakeholder satisfaction scores and the practical impact of audit recommendations. The Head of Audit and Risk Management would systematically track the depth of business insight provided and the overall cost-efficiency to ensure alignment with the Council’s long term financial and strategic interests. This option would be used to provide a large proportion of the internal audit days required by Haringey.

The framework agreement rates are based on different daily rates for the various audit areas such as IT; Contract; and general audit (including schools). This was in line with the Council’s current contract. The daily rate costs in the new framework were, collectively an increase on current costs but represent good value for money for the Council compared to other options.

The framework agreement rates would be subject to review and a Retail Prices Index-linked increase in April each year. Over the four-year period, the contract value was expected to be up to £2.0m for Haringey Council. The internal audit service for Homes for Haringey and Haringey Community Benefits Society was provided via the current framework.

There were clear administrative benefits in retaining the services of the existing supplier because they were fully conversant with the Council’s operational arrangements, systems and processes as well as the standard of work the Council expects and would therefore provide staff with the requisite skills.

As stated at 5.7.2 above, the contract for the internal audit service would be between Haringey Council and Croydon Council and it was being recommended that Haringey Council enter into a contract for a four-year period from 1 October 2026.

The framework agreement, whilst being ‘managed’ by Croydon Council, would be delivered through Mazars. It was considered highly likely, although not guaranteed, that the current provider would continue to utilise staff working on the existing Haringey contract, thus retaining their accumulated knowledge about the Council.

In terms of contract payment and monitoring arrangements, unlike previously, Mazars will invoice Haringey Council directly for the audit work completed in accordance with the framework agreement’s daily rates and Haringey Council would undertake regular contract monitoring and review meetings with Croydon and Mazars. Regular group meetings of the existing framework users already take place and it was envisaged that these would continue under the new framework agreement to ensure service developments and operational arrangements are satisfactory. Monthly contract monitoring review meetings take place under the current contract to ensure compliance with terms and conditions of the contract, including performance and output standards; and locally agreed performance and reporting arrangements. These meetings would continue under the proposed new contract.

The following outlines the contractual arrangements which would be in place if the council were to use the Croydon Council framework agreement:

a) Croydon Council and Mazars This is the framework agreement onto which Croydon Council appointed Mazars following a full tender process for the provision of internal audit and anti fraud services. This framework agreement commenced from 1 April 2026 and run for four years (to 31 March 2030).

b) Contract between Haringey and Croydon Council

A contract would be established between Haringey and Croydon Council, whereby Croydon would undertake to provide Haringey with a number of audit days as per its requirement/ specification. Croydon Council would be responsible for delivering the services by calling-off a sub-contract from their framework agreement with Mazars.

c) Letter of engagement between Haringey Council and Mazars

This agreement was necessary to ensure that the process remains as streamlined as possible at the operational level and allows existing working practices to continue as far as is required. This agreement would enable Mazars to issue all audit reports direct to Haringey Council, rather than via Croydon Council

Minutes:

Haringey Council’s internal audit service sought to access and call-off from two local authority framework agreements to provide an effective internal audit in order to comply with statutory requirements and achieve the best value for money for the Council.

Following queries from the cabinet member, it was explained that the Croydon framework was a single-provider framework, whereas the proposed framework was a multiple-provider framework. The multiple-provider approach would provide greater flexibility and resilience, as the Council would not be tied to a single provider. Should there be any difficulties, including in relation to staffing or the quality of service, the Council would have the option to access an alternative provider.

It was noted that the Council had previously used the Croydon framework, which provided an established route for audit work. However, the proposed approach would provide access to a wider range of providers and would allow the Council to commission specialist services where required.

The officer explained that the scope of the framework was broad and could accommodate a range of activities and specialist requirements in the future, including potentially specialist technological or financial services. The two frameworks would therefore provide greater flexibility to meet the Council’s requirements as they arose. It was explained that an analysis had been undertaken to determine which option represented the best value for money, and that the most advantageous option would be used. Where other requirements arose in the future, alternative procurement options could also be considered.

It was noted that, under a mini-competition approach, a number of pieces of work could be bundled together and providers could then compete to offer the most competitive price. The Cabinet Member also asked whether insourcing the work had been considered. It was explained that insourcing was not considered appropriate at this time. Changing the structure to increase the Council’s in-house audit resource would not provide the same level of accessibility or flexibility as using an external provider, particularly given that the Council’s requirements and workload were subject to change.

The predominant driver was the changing demand on the authority, and the benefits of accessing a shared service model and external expertise were therefore considered to outweigh the benefits of increasing in-house capacity.