Internal Audit is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. The audit process utilizes a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and the governance process.
I. Engagement Notification Letter
The Audit Engagement Letter is issued to notify management of the impending audit, which includes the audit subject and audit type. All audit reviews except investigations are engaged with a notification letter to management.
Helpful hint: Review the letter and ask questions if you don't understand why certain activities have been included or excluded.
II. Planning
Audit planning during an engagement means gaining a thorough understanding of the unit or process being audited. The objective of this phase is to enable the auditors to develop a specific audit plan and scope for the review.
Once the audit plan is completed and approved, the audit plan will consist of the following:
Audit Objective
Audit Scope
Background
Testing Methodology
Project Timeline
Helpful hint: Share any internal control concerns you have regarding the unit being
audited.
III. Opening Meeting (if necessary)
The opening meeting is used to communicate the audit objective, scope, methodology and timeline at the conclusion of the planning phase. Attendees include concerned parties up to and including Senior Management.
IV. Fieldwork
The auditor will review departmental records and conduct interviews of departmental personnel focusing on internal controls and regulatory requirements. The fieldwork consists of collecting, documenting, analyzing and interpreting policies and procedures within the organizational unit. The fieldwork verifies that controls are working as intended. Through out the audit, the auditor will communicate significant findings with management.
Helpful hint: As audit results are shared with management, please review the preliminary results and begin thinking about possible corrective actions.
V. Reporting
The most critical piece of the audit assignment is effectively communicating the results. The communication must be clear, concise and logically structured. All audit reports will be filed electronically and distributed to Internal Audit's standard distribution list.
Usually, audit reports with concerns will contain the following:
Findings - Audit findings emerge by a process of comparing what should be with
what is. These findings are a result of the field work.
Recommendations - Recommendations are proposed actions to correct existing
conditions or to improve operations.
Management Response - Management will have a specific amount of time in
which to complete their response to the audit findings in the report.
Management's response should include whether they agree with the finding, a
specific action plan to correct the weakness, the name of the person responsible
for making the corrections, and the timeline in which the corrections will be
made.
Draft Report - The report draft will be issued within 10 business days after the
fieldwork. If there are significant changes to the report resulting from client
communication, the draft will be edited and sent again to the client for review.
Helpful hint: Communication is vital between the auditor and client to ensure report
accuracy.
VI. Closing Meeting (if necessary)
At the conclusion of fieldwork, draft report and further communication, Internal Audit will meet with management to reiterate the audit report and management responses before final report issuance. The most important aspect of this meeting is that the auditor and client achieve a consensus regarding the accuracy of the audit observations and facts pertaining to the data. Internal Audit strives to hold the closing meeting within 20 days after the conclusion of the field work.
VII. Final Audit Report
The Final Audit Report will be issued after the client has formally responded to the draft report findings and the closing meeting has been conducted. All audit reports will be filed electronically and distributed to Internal Audit's standard distribution list.
Helpful hint: Communication is vital between the auditor and client to ensure report accuracy.
VIII. Client Satisfaction Survey
The Client Satisfaction Survey is used to provide feedback for Internal Audit. This information is used to improve the existing audit process. It is essential that Internal Audit's clients provide feedback regarding the audit process for improvements. The survey results will be included in Internal Audit's Annual Report.
IX. Follow-up
Reporting on the status of corrective action is vital. Internal Audit performs a follow-up review to assess the status of corrective actions within six to eighteen months after the audit completion date. Internal Audit will then issue a follow-up report.
Audit Process
Internal Audit Definition
Internal Audit is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. The audit process utilizes a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and the governance process.
I. Engagement Notification Letter
The Audit Engagement Letter is issued to notify management of the impending audit, which includes the audit subject and audit type. All audit reviews except investigations are engaged with a notification letter to management.
Helpful hint: Review the letter and ask questions if you don't understand why certain activities have been included or excluded.
II. Planning
Audit planning during an engagement means gaining a thorough understanding of the unit or process being audited. The objective of this phase is to enable the auditors to develop a specific audit plan and scope for the review.
Once the audit plan is completed and approved, the audit plan will consist of the following:
Helpful hint: Share any internal control concerns you have regarding the unit being audited.
III. Opening Meeting (if necessary)
The opening meeting is used to communicate the audit objective, scope, methodology and timeline at the conclusion of the planning phase. Attendees include concerned parties up to and including Senior Management.
IV. Fieldwork
The auditor will review departmental records and conduct interviews of departmental personnel focusing on internal controls and regulatory requirements. The fieldwork consists of collecting, documenting, analyzing and interpreting policies and procedures within the organizational unit. The fieldwork verifies that controls are working as intended. Through out the audit, the auditor will communicate significant findings with management.
Helpful hint: As audit results are shared with management, please review the preliminary results and begin thinking about possible corrective actions.
V. Reporting
The most critical piece of the audit assignment is effectively communicating the results. The communication must be clear, concise and logically structured. All audit reports will be filed electronically and distributed to Internal Audit's standard distribution list.
Usually, audit reports with concerns will contain the following:
Helpful hint: Communication is vital between the auditor and client to ensure report accuracy.
VI. Closing Meeting (if necessary)
At the conclusion of fieldwork, draft report and further communication, Internal Audit will meet with management to reiterate the audit report and management responses before final report issuance. The most important aspect of this meeting is that the auditor and client achieve a consensus regarding the accuracy of the audit observations and facts pertaining to the data. Internal Audit strives to hold the closing meeting within 20 days after the conclusion of the field work.
VII. Final Audit Report
The Final Audit Report will be issued after the client has formally responded to the draft report findings and the closing meeting has been conducted. All audit reports will be filed electronically and distributed to Internal Audit's standard distribution list.
Helpful hint: Communication is vital between the auditor and client to ensure report accuracy.
VIII. Client Satisfaction Survey
The Client Satisfaction Survey is used to provide feedback for Internal Audit. This information is used to improve the existing audit process. It is essential that Internal Audit's clients provide feedback regarding the audit process for improvements. The survey results will be included in Internal Audit's Annual Report.
IX. Follow-up
Reporting on the status of corrective action is vital. Internal Audit performs a follow-up review to assess the status of corrective actions within six to eighteen months after the audit completion date. Internal Audit will then issue a follow-up report.