What Happens During an Audit?
First, you will receive an email to inform you of an upcoming audit. The auditor will send you a preliminary checklist, which is a list of documents that will help the auditor learn about your unit before planning the audit.
After reviewing the information, the auditor will plan the review and identify key risks within the area, draft an audit plan, and schedule an opening conference.
The opening conference should include senior management and any administrative staff that may be involved in the audit. During this meeting, the scope of the audit will be discussed. You should feel free to ask the auditors to review areas that you are concerned about. The time frame of the audit will be determined, and you should discuss any potential timing issues (e.g. vacations, deadlines) that could impact the audit.
After the opening meeting, the auditor will finalize the audit plan and begin fieldwork. Fieldwork typically consists of talking with staff, reviewing procedure manuals, learning about your business processes, testing for compliance with applicable policies and procedures and laws and regulations, and assessing the adequacy of internal controls. Please note that often times the majority of our audit testing can be performed at our offices, but there will be times in which we will need access to you and your staff in order to obtain documents and/or ask questions. We understand that you still have your job to do and we will always strive to make the interruptions as minimal as possible.
The results of the audit will be communicated via a formal audit report. The purpose of this written document is for Internal Audit to report the conclusions drawn from the audit tests, observations and inquires.
A closing meeting will be held so that everyone can discuss the audit observations. The exit conference provides an opportunity to resolve any question or concerns you may have about the observations and to resolve any other issues before the final audit report is released.
Once the report is finalized with any corrections management may have suggested, we will request your responses. You may accept the recommendations offered by Internal Audit, present your own remedy to the findings noted, or accept the risks associated with the findings. Estimated completion dates for each observation should be included with all management responses.
Once responses are received, the final audit report is compiled and distributed to the Chancellor, Board Finance Committee as well as to the appropriate level of management.
Follow-up reviews are performed on an issue-by-issue basis and typically occur shortly after the expected completion date, so that agreed-upon corrective actions can be implemented. The purpose of the follow-up is to verify that you have implemented the agreed-upon corrective actions. The auditor will interview staff, perform tests, or review new procedures to perform the verification. If further corrective action is required, you will need to write a management response. Otherwise, the issue will be reported as resolved.