Audit Procedures
Notification
Contact department management at least two weeks in advance of scheduled audit date to discuss risk considerations that led to the audit being on the annual plan, expected scope of the audit, and current management concerns.
Audit Planning
Develop preliminary audit program outlining anticipated scope, risk assessment, procedures and schedule.
Schedule an Entrance Meeting with department management and staff, and other stakeholders as appropriate, to go over and finalize the audit program, obtain documents, schedule interviews and communicate expected audit completion date.
Audit Fieldwork
Carry out fieldwork as indicated in the audit program.
Obtain cooperation from the line management and department staff as necessary to identify, obtain documentation and conduct interviews, etc.
Conduct fieldwork with minimal disruption to department operations; for example, whenever possible, obtain information from central sources rather than from departmental staff or line management.
Report Results
In general, share important and sensitive findings with responsible managers immediately upon verification by the auditor; short memo reports may be used in this process.
Prepare a first draft final report and discuss it with responsible managers immediately following the fieldwork.
Wrap-up Audit
Schedule an Exit Meeting after responsible managers have received the first draft report; this meeting will provide the opportunity for responsible managers to discuss findings, conclusions, and recommendations with the auditor.
During or immediately after the Exit Meeting, ask responsible managers to provide their responses to the auditor's findings and recommendations, either in writing or in sufficient detail for the auditors to capture them and reduce them to writing in the final draft report.
Review Final Report
Send final draft report to responsible managers and discuss suggested changes.
After processing changes, issue the final report to the distribution indicated on the cover of the final draft. (Note: All reports will contain an executive summary which summarizes the primary observations, management responses, and auditor's conclusion.)
Disseminate Report
Provide the full report to members of the Audit & Governance Committee, the President, the CFO and the department heads in the area being reported.
Provide the Comptroller with copies of any reports with financial system findings. Provide to the Provost and Dean of each academic department when appropriate.
Evaluate and Follow Up
At the completion of each audit, the auditor will send an evaluation survey form to the primary clients of the audit. This form should be completed and returned to the Office of Internal Audit, in order to ensure continuous improvement of these procedures and the internal audit function.
Approximately six months following completion of each audit, the auditor will conduct a follow-up review to verify the completion of agreed-upon management actions and ascertain the status of open recommendations. A follow-up report will be generated annually for distribution to senior management and members of the Audit & Governance Committee.