Our audit process utilizes a collaborative approach to evaluate the effectiveness and efficiency of risk management, controls and the governance process.
Activities are selected for review based upon an annual risk assessment process or through concerns expressed by management.
A notification of the impending audit is issued to management, which includes the audit subject and audit type. All reviews, except investigations, are begun with a notification to management.
The objective of this phase is to enable the auditors to gain a thorough understanding of the unit or process, in order to develop a specific audit plan and scope for the review. During this phase, Internal Audit will conduct operational observations and interviews.
The fieldwork phase consists of collecting, documenting, analyzing and interpreting policies and procedures. These policies and procedures are externally validated and verified within the organizational unit through the review of departmental records and additional interviews.
The reporting phase effectively communicates results in three phases: the closing meeting, draft report and final report.
The reporting phase usually contains:
- Observations – Conditions identified that require management's awareness
- Recommendations – Proposed actions to address existing conditions or to improve operations
- Management Response - This typically includes:
- Agreement or disagreement with the observation
- An action plan to address the condition
- A timeline in which actions to address the condition will be made
At the conclusion of fieldwork, Internal Audit will meet with management to discuss the audit observations. The most important aspect of this meeting is that the auditor and client achieve a consensus regarding the accuracy of the audit observations and facts pertaining to the data. Internal Audit strives to hold the closing meeting within 20 days of the conclusion of the fieldwork.
The draft report will be issued to the client within 10 business days after the closing meeting for consensus. Management's response is requested during this phase of the reporting process.
The final audit report, including observations, recommendations, and management response, will be distributed to the client and, as warranted, to University Administration.
Internal Audit performs a review, as warranted, after the audit completion to assess the status of the observations. A report of the present status of the observations is issued. If necessary, Internal Audit will continue to follow up on all audit observations until they have been addressed in a satisfactory manner.