Learn about the Audit Process

Step 1: Planning

Internal Audit will gather preliminary information and review any prior audits in your area. A preplanning meeting is conducted to ensure that sufficient background information is gathered.

Internal Audit will review internal policies and procedures, regulatory requirements, the external auditor’s assessment (i.e., management letter comments), related financial information from University systems or other financial reports, the organizational chart, the risk assessment, and best practices.

Step 2: Notification

Internal Audit will notify the appropriate department personnel of the upcoming audit via an announcement memo. The announcement memo defines the scope, objective and timing of the audit.

Step 3: Opening Meeting

At the opening meeting, Internal Audit will introduce the staff who will be conducting the audit. This is also the opportunity to meet the relevant managers and other staff who may be integral to the audit.

Internal Audit confirms the scope and objective as defined in the memo as well as the timing and any events that may impact the timing - such as vacations or other leaves of absence.

Internal Audit reviews the audit process and establishes communication channels and addresses any specific requests related to such.

Step 4: Fieldwork

Internal Audit will work with management to gain an understanding of the process being reviewed and will identify the controls in place.   

Internal Audit will document the process through a narrative or flowchart or both if the documentation is not available. This is accomplished through interviews with department personnel and a walkthrough of a typical transaction. 

In addition, Internal Audit identifies controls used by the area and will perform tests of controls to help ensure that control activities are performed according to expectations and are effective in their objectives. During this phase, there will be interaction with department management and personnel to ensure the accuracy of the audit observations. 

Once fieldwork and testing are completed, Internal Audit will formalize the listing of issues identified and will schedule a closing meeting.

Step 5: Closing Meeting

Internal Audit discusses the issues and recommendations with you to obtain mutual agreement and, if possible, of the action plans you are considering.

Attendance (generally AVP, director, senior manager, auditor performing the audit) and senior management, manager, directors - auditee.

Modifications made to issues when appropriate, additional fieldwork or testing may be identified to be performed to clarify any questions that may arise.

Step 6: Report Drafting

Internal Audit will issue the draft report generally up to 14 days after the Closing Meeting provided additional work and/or meetings were not required to clarify any issues. The draft report will include observations and recommendations for corrective action or improvement

This sample report template can give you a sense of the draft report you will receive from the Office of Internal Audit.

Step 7: Management Response

Management responses should include an action plan to correct any deficiencies along with the proposed date of implementation the individual responsible for the corrective action – action plan coordinator.

Clarifications and questions are welcomed as management works on their responses and corrective action plans. 

Responses to the draft report are expected within 21 days of receipt of the draft report.

Step 8: Final Audit Report Distribution

Once management’s response has been received, Internal Audit ensures that responses directly address the issues identified.

The department will distribute the final audit report to the auditee senior management, Executive VP for Finance, the Senior Executive VP for Finance, the Provost, the President, the Audit Committee Chair, the Independent Auditor, and other management as appropriate.

The final report is generally issued within 5 days after receipt of management’s response.

Step 9: Audit Follow-up

Audit follow-up will occur for reportable issues (where risk rating is high). We will contact the issue coordinator to determine whether corrective actions have been taken by the date indicated in management’s response.

Follow-up action may occur at the time of the audit if issues have already been addressed prior to the close of the audit and is clear-cut and can be easily confirmed.

Other follow-up on issues will require additional time. The verification of action plans can occur at a later time or as part of a follow up audit.

Step 10: Audit Committee

Internal Audit reports our activity to the Audit Committee on a quarterly basis. 

Reporting includes:

• Audit activities (completed, in progress, planned)
• Open reportable issue status
• Current reportable issues
• Current reportable management response

Sample Internal Audit Draft Template

To give you a sense of the Internal Audit Draft Report you will receive in the event of an audit.