What to expect if you have been selected for an audit?
INTRODUCTORY LETTER
Internal Audit (IA) will notify the Dean, Director, Manager, etc. by email that their College/Department has been selected to be audited. Areas are generally selected for audit based upon IA's Annual Risk Assessment. The introductory letter will include the audit scope, objectives, and timeframe for the audit. The University President and other key university stakeholders are copied on the introductory letter.
ENTRANCE CONFERENCE
An entrance conference will be scheduled by IA to discuss the audit scope and objectives in more detail. The audit process and timeframe will also be discussed. Auditees should discuss any concerns or questions they have regarding the audit. Policies, procedures and key contacts should be provided by the auditee at the entrance conference.
FIELDWORK
Internal Audit will obtain knowledge of the auditee from discussions with College/Department personnel, review of internal controls and policies and procedures. Transactions will be tested by examining supporting documents to ensure compliance with University, State and Federal policies and procedures. IA will discuss with appropriate personnel areas that may be non-compliant and potential recommendations as they arise during the audit. The length of fieldwork can vary based on availability of the auditee and access to records.
DRAFT AUDIT REPORT
Internal Audit will compose a draft audit report once fieldwork is completed. The draft report includes an executive summary (audit scope, objectives, background information), audit findings with associated risk (high, medium, low), and recommendations. The auditee will be provided a copy of the draft audit report prior to the exit conference.
EXIT CONFERENCE
An exit conference is scheduled with the auditee to review the draft report. IA will review the draft report with the auditee to ensure all parties understand and are in agreement with each finding, associated risk and recommendations. IA will then discuss the next steps for the auditee which include management responses, action plans and a target date for completion for each audit finding. These items will be included in the final report and should be provided to IA within two weeks of the exit conference.
FINAL AUDIT REPORT
Once management responses are received, IA will prepare the final audit report to be submitted to the auditee along with the University President, key university stakeholders and the Audit Commitee.
FOLLOW UP
Internal Audit will follow up with the auditee as target dates for action plans are due to ensure plans are completed as noted in the final report. Responses and any required documentation must be provided upon request to IA by the auditee. If completion dates are not met, an updated completion date and explanation for the extension must be provided. In some cases, follow up testing by IA may be required.