Steps of an Audit
Generally, Internal Audit notifies auditees in writing when their area is selected for an audit. This letter is sent to the director, dean, chair, or manager of the entity to be audited. The notification letter states the objectives to be accomplished in the audit. Management is not notified in advance for investigations, cash counts or certain purchase card audits.
Internal Audit schedules an entrance conference with the head of the department to discuss the purpose and scope of the audit. Auditees are encouraged to discuss any concerns or questions they have about the audit. Together, the auditee and the auditors determine the departmental personnel and physical facilities needed to conduct the audit.
The objective of the survey process is to gain sufficient knowledge of an entity so Internal Audit can design an audit plan to accomplish the assigned objectives. This survey is a thoughtful, systematic approach to determining the scope, and methodology to be used. The survey process consists of familiarization, problem identification, internal control review, and audit planning detail.
Internal Audit performs audit steps according to the audit plan developed during the survey. These steps usually consist of examining supporting documents in order to identify procedures and make any necessary recommendations. Internal control systems and procedures are evaluated through the observation of the unit's operations, discussions with the director and/or unit staff, and the review of a sample of transactions.
The emphasis of the evaluation is to determine if there are adequate control systems and whether the systems are functioning as intended. The controls are measured against University, State and Federal policies and procedures, as well as, generally accepted accounting principles. Areas of deficiency and potential recommendations are discussed with the appropriate staff and are documented in the audit work papers.
The duration of an audit will vary depending on its scope, level of cooperation from the auditee, and access to personnel and records.
After the field work is completed, Internal Audit produces a draft audit report. This report includes background information, audit observations, and recommendations for corrective action or improvement. Management is provided a copy of the draft report for review prior to the exit conference.
Internal Audit schedules a meeting with the same individuals who attended the entrance conference. At the exit conference, the draft audit report is reviewed so all of the parties understand the nature of the recommendations and agree upon the possible solutions to any problem areas. Any misunderstandings or possible misstatements contained in the draft report are identified and resolved. Any deficiencies identified during the audit which are not significant enough to be include in the report are also discussed.
Management is given 30 days to respond in writing to the audit report. This response will indicate what actions were taken or are planned in regard to the specific observations and recommendations in the audit report. Management responses should include a timetable for the anticipated completion of their actions.
After receiving the management response, Internal Audit submits a final report to the Vice President of the area being audited as well as to the appropriate Dean, Chairperson, or Director. In addition, a copy of the report is submitted to the University President. Reports are made available to the Audit Committee of the State Board of Education upon their request.
Internal Audit conducts a follow-up review approximately six to twelve months after the audit. The purpose of the follow-up is to verify management has implemented the agreed-upon corrective actions. Internal Audit will interview staff, perform tests, and/or review new procedures. A follow-up memo will be issued describing the results of the review and indicate whether further actions are necessary.