INTERNAL AUDIT BRIEFING Business Objectives Business Objectives: What are they and how are they used?

INTERNAL AUDIT BRIEFING Business Objectives Outcomes At the end of this you should understand: what a business objective is; the relationship between business objectives and risks and controls; how to categorise business objectives; business objectives and their role in the three lines of defense;

INTERNAL AUDIT BRIEFING Business Objectives System Objective Every system will have an objective; This will be linked to the strategy of the organisation; An example could be: “The Authority will provide a grounds maintenance service that is efficient and provides value for money” SYSTEM OBJECTIVE

INTERNAL AUDIT BRIEFING Business Objectives Business Objective The System objective can then be analysed by Business objectives; These function at an operational level, to help deliver the System objective; Examples could include: –“Financial: To ensure that contract payments are accurate;” –“Financial: To ensure that revenue is accurate and collected promptly;” –“Contractual: To ensure that services are delivered to specified standard; SYSTEM OBJECTIVE BUSINESS OBJECTIVE

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational To help identify your business objectives it can be useful to reflect on some of the typical categories. They are not always mutually exclusive, and other specific objectives may exist. They are a good starting point.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational The need to maintain knowledge of and comply with a profession’s standards E.g. for the interpretation of Planning laws or Data Protection rules.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational The need to ensure cash security or collection of income and the adequacy of insurance cover. E.g. cash handling, reconciliation of receipts.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational Those related to possible breaches of legislation by the Council. E.g. Health and Safety regulations, Equalities legislation.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational Those related to fire, security, accident prevention and health and safety. E.g. hazards / risks associated with buildings, vehicles plant and equipment.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational Those associated with the reliance upon contractors / partners to deliver services or products to the agreed cost, specification or standard.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational Those relating to reliance upon operational equipment. E.g. IT systems or equipment and machinery.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational Those relating to pollution, noise or energy efficiency of ongoing service operation or external cause.

INTERNAL AUDIT BRIEFING Business Objectives Categories for identifying Business Objectives Professional Financial Legal Physical Contractual Technological Environmental Reputational Those that might cause concern to or require further information for stakeholders. E.g. citizens and media.

INTERNAL AUDIT BRIEFING Business Objectives Inherent Risk Consider the risks to you achieving your objectives and the impact they could have; If not managed you will fail your objectives; SYSTEM OBJECTIVE BUSINESS OBJECTIVE RISKS

INTERNAL AUDIT BRIEFING Business Objectives Controls By putting in adequate controls you can help reduce the likelihood and / or the impact caused by the risks. SYSTEM OBJECTIVE BUSINESS OBJECTIVE CONTROLS RISKS Examples could incude: - Financial: Creditor invoice details are checked against goods received; - Financial: Sundry debtor invoice request is raised when order is received; - Contractual: Inspect sample of completed works for quality assurance;

INTERNAL AUDIT BRIEFING Business Objectives Residual Risk Residual risk is left after controls are implemented. Residual risk should be insignificant enough to be tolerated. SYSTEM OBJECTIVE BUSINESS OBJECTIVE CONTROLS RISKS

INTERNAL AUDIT BRIEFING Business Objectives The 3 lines of defense – incorporating control in the workplace RISK 1st Deliver the risk and control environment Management Business Operations 3rd Internal Audit Independent assurance / advice 2nd Management Oversight Functions Functional oversight, strategy and policy setting Reporting on Risks and KPIs Corporate Governance: Corporate Management Team Political members Public / taxpayers Assurance The controls that prevent risks being a threat to the Business Objectives are the first line of defense. It is the responsibility of Management to ensure these are adequate. A pragmatic risk based approach to implementation of controls should be adopted. Senior Management are responsible for monitoring the operational risk management. They will seek evidence – risk registers, performance monitoring. Where required operational risks should be fed into the Strategic Risk Register. Internal Audit can provide consultancy advice on the effectiveness and efficiency of controls. A sample of systems are tested for adequacy of internal control annually. However they are not the control itself, as independence is requried. The 3 lines of defense link back to the strategic objectives of the organisation, and provide assurance to stakeholders. R I S K

INTERNAL AUDIT BRIEFING Business Objectives Conclusion: Outcomes revisited You should now understand: what a business objective is; the relationship between business objectives and risks and controls; how to categorise business objectives; business objectives and their role in the three lines of defense;