78

Following receipt of the highest available award level from the External Quality Assessment in 2024 conducted by the Institute of Internal Auditors, the Internal Audit team has continued to regularly self-assess and implement continuous improvement activities that enable a response to developments in the public sector internal audit landscape. Areas of focus continue to be increased use of data analytics and a more mature consideration of wider assurance sources in audit planning and delivery.

Updated Global Internal Audit Standards came into effect in January 2025 with a framework for the application of the standards in the UK Public Sector effective from 1 April 2025. Additionally, the Institute of Internal Auditors has developed a series of Topical Requirements which must be considered during audit work. The first on cybersecurity is effective from February 2026, with upcoming requirements on the auditing of third parties and organisational behaviour effective later in 2026.

The overall opinion for 2025-26 has also considered the outputs of assurance reviews conducted by specialist third-party IT audit specialists. These reviews covered Data Governance, the EIS Cloud/Digital Strategy, Resilience and Disaster Recovery, and Third-Party Risk Management. The contract for Internal Audit's IT audit specialists has recently been renewed for three years following a competitive procurement exercise involving all affected partner organisations. Internal Audit will continue to work with EIS to strengthen how assurance is provided across the partnership.

The Internal Audit Partnership continues to provide Internal Audit services for Scottish Enterprise, Skills Development Scotland, the Scottish Funding Council, South of Scotland Enterprise and Clyde Gateway, with Scottish Enterprise taking the lead in delivering services across each organisation. In 2025-26, Internal Audit shared a paper with the Audit and Risk Committees of each partner organisation which included thematic insights from reviews of Risk Management conducted at four of the partner bodies. A similar paper on good practice from our 2025-26 reviews of Counter Fraud Arrangements will also be shared.

The Auditor General for Scotland is responsible for auditing the Scottish Enterprise consolidated accounts. Under the Public Finance and Accountability (Scotland) Act 2000, the Auditor General for Scotland has appointed Audit Scotland to undertake the statutory audit of Scottish Enterprise for a period of five years starting with the year to 31 March 2023.

During 2025-26, Audit Scotland reviewed Scottish Enterprise's control environment and concluded that there were no significant issues that required to be reported.

Scottish Enterprise subsidiary companies are subject to external audit by Thomson Cooper Limited.