Audit Process

Our audit process utilizes a collaborative approach to evaluate the effectiveness and efficiency of risk management, controls and the governance process. The steps are outlined below.

Audit Selection

Activities are selected for review based upon an annual risk assessment process or through concerns expressed by management.


Audit Notification

A notification of the impending audit is issued to management, which includes the audit subject and audit type. All reviews, except investigations, are begun with a notification to management.



The objective of this phase is to enable the auditors to gain a thorough understanding of the unit or process, in order to develop a specific audit plan and scope for the review. During this phase, Internal Audit will conduct operational observations and interviews.



The fieldwork phase consists of collecting, documenting, analyzing and interpreting policies and procedures. These policies and procedures are externally validated and verified within the organizational unit through the review of departmental records and additional interviews.



The reporting phase ensures the effective communication of the results so that management is duly informed and has ample time to formulate an action plan and aptly respond to the individual findings. The reporting is typically conducted in three phases: the closing meetingdraft report and final report. The reporting phase usually contains:

  • Observations – Conditions identified that require management's awareness
  • Recommendations – Proposed actions to address existing conditions and to improve operations
  • Management Action Plan – Included in the final report, this typically includes statements of agreement or disagreement with the observation, an action plan to address the condition(s) and a timeline in which actions to address the condition will be made.
  • Check-ins – Approximately 90 days following the distribution of the final report, UK Internal Audit will check in with the client to hear about the progress that the unit is making on its Management Action Plan (MAP) and see if there are any challenges or obstacles with which we may assist or provide guidance.



Internal Audit performs a review, as warranted, after the audit completion to assess the status of the observations. A report of the present status of the observations is issued. If necessary, we will continue to follow up on all audit observations until they have been addressed in a satisfactory manner.