| What
occurs on a routine audit
I.
Audit Scheduling
Although a common courtesy, the Office of the Internal Auditor is
not required to give notice prior to performing an audit. In cases
where notice will be given, the Internal Auditor will contact the
management of the area to schedule a beginning date for the audit.
Prior to the beginning date, the Internal Auditor will schedule
an entrance conference with the manager and other personnel whom
the manager and auditor consider appropriate. If scheduling problems
arise, the Internal Auditor should be notified immediately.
II. Audit Planning
The auditor assigned to conduct the examination will review the
files of prior audits (if any), review applicable professional literature,
research any applicable policies or statutes, and prepare an Audit
Program.
The program details the tests and procedures required for each step
of the audit. Audit work papers will provide evidence of completion
of specific audit program steps and support of audit findings.
III.
Entrance Conference
At this meeting, the managers and other personnel of the area to
be audited and personnel from the Office of the Internal Auditor
will discuss the purpose and scope of the audit, the Audit Program,
and the audit reporting procedures. Any special concerns of the
department should also be discussed during this time to be included
in the Audit program.
IV.
Audit Program
Based upon the information obtained during the entrance conference,
the Audit Program may be adjusted. It is also possible that the
Audit Program may be modified if it is determined that information
gathered during the entrance conference is not substantiated.
V. Fieldwork
The auditor’s performance of the planned Audit Program is
referred to as fieldwork. The fieldwork will begin with a review
of internal controls.
With the exception of first-time audits, when considerable audit
testing is necessary, the scope and extent of testing may be reduced
substantially when internal controls are considered strong.
The fieldwork will include testing (compliance, analytical, etc.)
of various documents and departmental reports. Interviews may be
held with employees within a department to inquire about their duties.
Flowcharts of processes may be prepared to better understand the
controls in place. Most work will be performed in the department
being audited (if space permits). However, some audit work cannot
be performed in the departments and will be completed in the auditor’s
office.
During periods where the audit staff is working in the areas under
review, the auditors will minimize their demand on the time of personnel,
so that normal activities can be performed with minimal delays.
VI. Report Writing
Once the fieldwork has been completed, the auditor conducting the
review will compile a draft report detailing the Audit Program performed,
findings, and recommendations for improvement or corrective action.
A copy of this report will be forwarded to the management of the
area being evaluated for review regarding the accuracy of findings
and the propriety of recommendations.
The
OIA will change any information within the report to correct inaccuracies.
However, objective opinions stated in the report based upon accurate
facts cannot be compromised. Administration expects and is entitled
to an independent opinion. When there is a disagreement on the interpretation
of the facts, the report will be amended to express the positions
of both the internal auditor and the operating manager.
VII. Exit Conference
Management of the area under review should contact the Internal
Auditor within ten business days of the date the draft report was
issued to meet for the exit conference.
Usually, the same people who were present during the entrance conference
will be present during the exit conference. The purpose of this
meeting is to discuss the audit findings, recommendations, and the
need for corrective action as documented in the report.
The auditor will request the department head to submit a written
resolution of noted findings.
VIII. Departmental Response
A written response to the auditor’s draft report should be
prepared. The response should outline the actions taken or to be
taken to correct the deficiencies reported, and should be submitted
to the Office of the Internal Auditor to be included in the final
report. An adequate response to the auditor’s report is implementation
of the auditor’s recommendations stated in the report, the
implementation of alternative procedures that provide approximately
the same degree of control as the auditor’s recommended procedures,
or a statement explaining that management has assumed the risk of
not taking corrective action on the reported findings.
The Internal Auditor will specify a reasonable date by which departmental
responses should be submitted. If the department does not respond
within the appropriate time frame, the final audit report will be
issued noting the area under review had not provided a response.
IX.
The Final Report
Once the department under examination reviews the draft report and
submits a response to the OIA, the audit report is finalized and
distributed.
The final report is distributed to the President, the appropriate
Vice President, Dean (if applicable), and the department director
of the area audited.
X. Audit Follow-up
If deemed necessary, the OIA will conduct follow-up reviews of the
audited departments. The OIA shall determine that corrective action
taken is achieving the desired results.
|
