Internal Audit Services

1. Purpose and agreement period 1.1 Purpose The contract shall ensure NTNU access to independent, objective and risk based internal audit services of high professional quality. The internal audit shall contribute to strengthen NTNU ́s performance management, risk management and internal control and give the board an independent basis for assessment and follow-up. The agreement shall facilitate for continuity, good business understanding and a long-term cooperation, at the same time that the audit work shall be able to be adapted to changes in NTNU ́s risk picture, business and priorities. 2. Content of the Service 2.1 General The tenderer shall provide an overall internal audit service that includes: Preparation of annual risk based audit plan. Implementation of internal audits within the approved audit plan. Reporting audit results, findings and recommendations. Follow-up of measures after completed audits. Consultancy services for performance management, risk management and internal control within the limits of the independence of the internal audit. Ongoing dialogue with relevant parts of NTNU's management and organisation. Reporting to the board and other relevant decision-making bodies. Tenderers shall carry out the assignments with due diligence, objectivity and quality, in accordance with Global Standards for Internal Audit (GIAS) set by The Institute of Internal Auditors, in the at any given time applicable version, and NTNU ́s instructions for internal audits. If an assignment cannot be carried out in accordance with GIAS, the tenderer shall provide information on this in the report, stating which standards have not been followed, the reason and consequences for observations and conclusions. Special audits or surveys shall be possible if there is a need that is not included in the annual audit plan. 2.2 NTNU ́s guidelines The guidelines are attached. The version of the instructions that apply when the contract is signed, is dated 29 April 2018. October 2020. NTNU can update the guidelines during the agreement period. Changes that do not significantly affect the tenderer's obligations shall be followed within the agreed remuneration. 2.3 Annual risk assessment and audit plan Tenderers shall annually carry out a general risk assessment of NTNU ́s activities and prepare a justified proposal for the audit plan with the hourly budget for the coming years. The risk assessment shall be based on the understanding of NTNU's social mission, organisation, strategic aims and framework conditions. Tenderers shall obtain and assess relevant information from i.a. the board, university management, risk assessments, previous audits and other relevant sources. The tenderer shall justify the priorities. It shall be clear what risks the audits are meant to highlight, and what significant risks are not prioritised and why. The audit plan shall be processed and approved by NTNU's board of directors in accordance with the current management scheme. 2.4 Implementation of audits Each audit shall be planned and carried out based on an approved audit plan. After each audit, the tenderer shall prepare a report that is clear and relevant for decision making. Finds and recommendations shall be prioritised in accordance with materiality and risk. The principal shall continuously receive audit reports from the individual audits. The results of the audit activities performed shall be reported half yearly to the board. Serious conditions shall be reported at the first possible board meeting. The biannual reports shall mention completed audits, significant findings, status for follow-up of measures and any overall developments. 2.5 Follow-up and advice Consultancy shall be carried out in a way that safeguards the independence of internal audits. Tenderers shall not take over NTNU ́s management responsibility or decision authority.