Our audit process utilizes a collaborative approach to evaluate the effectiveness and efficiency of risk management, controls and the governance process. The steps are outlined below.
Activities are selected for review based upon an annual risk assessment process or through concerns expressed by management.
A notification of the impending audit is issued to management, which includes the audit subject and audit type. All reviews, except investigations, are begun with a notification to management.
The objective of this phase is to enable the auditors to gain a thorough understanding of the unit or process, in order to develop a specific audit plan and scope for the review. During this phase, Internal Audit will conduct operational observations and interviews.
The fieldwork phase consists of collecting, documenting, analyzing and interpreting policies and procedures. These policies and procedures are externally validated and verified within the organizational unit through the review of departmental records and additional interviews.
The reporting phase ensures the effective communication of the results so that management is duly informed and has ample time to formulate an action plan and aptly respond to the individual findings. The reporting is typically conducted in three phases: the closing meeting, draft report and final report. The reporting phase usually contains:
- Observations – Conditions identified that require management's awareness
- Recommendations – Proposed actions to address existing conditions and to improve operations
- Management Response – Included in the final report, this typically includes statements of agreement or disagreement with the observation, an action plan to address the condition(s) and a timeline in which actions to address the condition will be made.
Internal Audit performs a review, as warranted, after the audit completion to assess the status of the observations. A report of the present status of the observations is issued. If necessary, Internal Audit will continue to follow up on all audit observations until they have been addressed in a satisfactory manner.