The Audit Process
Planning
The head of the department or area being audited is informed in advance that an audit has been scheduled. One or more entrance conferences are held to provide the opportunity for the audit team and department members to meet each other and discuss the overall purpose and objectives of the audit. Tentative dates for fieldwork will be scheduled and issues or processes that members of the department would like included in Internal Audit's scope of work may be defined at this time.
During this initial planning phase of the audit, Internal Audit also talks with managers of central business offices, the General Counsel, and offices with which the audited department routinely interacts, to get different perspectives on the unit's operations and where to focus attention during the audit.
Fieldwork
Since each department is unique in its size, purpose, staffing, procedures, and problems, each audit is unique. The audit procedures that are outlined at the end of the planning stage and followed during the fieldwork stage depend on the nature of the audit service and are designed to focus on operations or controls that have been identified as the most important or the most problematic for the department. Test work steps may be expanded, eliminated, or otherwise adjusted as the audit progresses.
During a typical operational audit, Internal Audit performs an evaluation of the department's systems of internal control and tests the compliance with these controls by tracing a sample of transactions through the operations' processes. Key personnel are interviewed, office policies and manuals are reviewed, financial transactions processed through the University's central business systems are tested, and documents maintained by the department are examined. Compliance with University policies that are supposed to be administered at the department level (such as monitoring monthly budget reports and tracking vacation and sick leave) is reviewed, as is compliance with procedures that are important and specific to the department's mission.
Throughout the audit process, Internal Audit staff will keep the relevant managers or staff members advised informally of findings and attempt to resolve any issues that arise during the audit. Occasionally, a serious or urgent problem is discovered that Internal Audit will bring immediately to the attention of the appropriate senior officer(s) for corrective action. Also, an audit of one department may produce findings and recommendations for another department within the University to address.
Reporting
After the conclusion of fieldwork, Internal Audit prepares a draft of the audit report which is provided to department management for discussion purposes. The report should contain no surprises for the managers with whom Internal Audit has been working. The report is usually formatted with a paragraph explaining the background and scope of the audit, a paragraph providing a brief summary of the positive findings and areas for improvement that were identified in the audit, and a paragraph requesting management's response to the report. Findings and recommendations are attached in approximate order of priority. Recommendations which call for response from managers outside of the audited unit are referred to those managers for response.
An exit conference is scheduled among Internal Audit and relevant managers to discuss the substance and wording of the report and how management intends to respond to the recommendations. If there are significant changes to the draft, a second draft of the report may be issued. Management's written responses to Internal Audit's recommendations are requested within 30 days of the draft report's issuance.
The final version of the audit report acknowledges and incorporates management's responses to each recommendation. It is distributed to the Audit Committee Chair and the senior officers and department managers responsible for the operations being reported upon. Final internal audit reports are routinely requested by and provided to external auditors for review in conjunction with the annual audit of the University's financial statements.
Follow-up
After a reasonable period of time has passed for management to take the actions indicated in their response to the audit findings (usually after about one or two years), Internal Audit will schedule a follow-up audit. The follow-up audit involves outlining the findings and anticipated actions from the prior audit report, and determining if and how each matter has been resolved. Follow-up audits are typically shorter in duration than operational audits and involve inquiry of management and some limited test work. Follow- up audit reports outline the findings that have been completely resolved, those that are partially resolved, and the outstanding or new items that have not been addressed. They are issued in accordance with the same reporting process that is described above.