University of Kentucky, Lexington, Ky
Internal Audit: We provide reasonable assurance

Audit Process

Our audit process utilizes a collaborative approach to evaluate the effectiveness and efficiency of risk management, controls and the governance process.

Audit Selection

Activities are selected for review based upon an annual risk assessment process or through concerns expressed by management.

Audit Notification

A notification of the impending audit is issued to management, which includes the audit subject and audit type. All reviews, except investigations, are begun with a notification to management.


The objective of this phase is to enable the auditors to gain a thorough understanding of the unit or process, in order to develop a specific audit plan and scope for the review. During this phase, Internal Audit will conduct operational observations and interviews.


The fieldwork phase consists of collecting, documenting, analyzing and interpreting policies and procedures. These policies and procedures are externally validated and verified within the organizational unit through the review of departmental records and additional interviews.


The reporting phase effectively communicates results in three phases: the closing meeting, draft report and final report.

The reporting phase usually contains:

  • Observations – Conditions identified that require management's awareness
  • Recommendations – Proposed actions to address existing conditions or to improve operations
  • Management Response - This typically includes:
    1. Agreement or disagreement with the observation
    2. An action plan to address the condition
    3. A timeline in which actions to address the condition will be made

Closing Meeting

At the conclusion of fieldwork, Internal Audit will meet with management to discuss the audit observations. The most important aspect of this meeting is that the auditor and client achieve a consensus regarding the accuracy of the audit observations and facts pertaining to the data. Internal Audit strives to hold the closing meeting within 20 days of the conclusion of the fieldwork.

Draft Report

The draft report will be issued to the client within 10 business days after the closing meeting for consensus. Management's response is requested during this phase of the reporting process.

Final Report

The final audit report, including observations, recommendations, and management response, will be distributed to the client and, as warranted, to University Administration.


Internal Audit performs a review, as warranted, after the audit completion to assess the status of the observations. A report of the present status of the observations is issued. If necessary, Internal Audit will continue to follow up on all audit observations until they have been addressed in a satisfactory manner.