The most successful audit projects are those in which the client and Internal Audit and Management Services have a constructive working relationship.
Our objective is to have the client's continued involvement at every stage, so that they understand what we are doing and why we are doing it.
Although every audit project is
unique, the audit process is similar for most engagements and normally
consists of four stages: Preliminary Review, Field Work, Audit Report,
and Follow-up Review. Client involvement is critical at each
stage of the audit process. As in any special project, an audit
results in a certain amount of time being diverted from your unit's
usual routine. One of our key objectives is to minimize this
time and avoid disrupting your on-going activities.
Back to top of page
First we gather information about the processes. We then review and evaluate the existing internal control structure and identify the fieldwork objectives. Finally, we plan the remaining audit steps necessary to achieve our objectives.
The client is informed of the audit project through an announcement letter from the Director. This letter communicates the scope and objectives of the audit and the auditor(s) assigned to the project.
During this meeting, the client describes the unit or system to be reviewed, the organization, available resources (personnel, facilities, equipment, funds), and other relevant information. The internal auditor meets with the senior officer directly responsible for the unit under review and any staff members he/she wishes to include. It is important that the client identify issues or areas of special concern that should be addressed.
In this phase the auditor gathers relevant information about the unit in order to obtain a general overview of operations. He/she talks with key personnel and reviews reports, files and other sources of information.
Internal Control Review
The auditor will review the unit's internal control structure, a process which is usually time-consuming. In doing this, the auditor uses a variety of tools and techniques to gather and analyze information about the operation. The review of internal controls helps the auditor determine the areas of highest risk and design tests to be performed in the field work section.
Preparation of the audit program concludes the preliminary review phase. This program outlines the fieldwork necessary to achieve the audit objectives.
The field work concentrates on transaction testing and informal communications. It is during this phase that the auditor determines whether the controls identified during the preliminary review are operating properly and in the manner described by the client. The field work stage concludes with a list of significant findings from which the auditor will prepare a draft of the audit report.
After completing the preliminary review, the auditor performs the procedures in the audit program. These procedures usually test the major internal controls and the accuracy and propriety of the transactions.
Advice and Informal Communications
As field work progresses, the auditor discusses any significant findings with the client. Hopefully, the client can offer insights and work with the auditor to determine the best method of resolving the finding. Usually these communications are oral. However, in more complex situations, memos can be written in order to ensure full understanding by the client and the auditor. Our goal: No surprises.
Upon completion of the fieldwork, the auditor summarizes the audit findings, conclusions, and action to be taken (as agreed upon by both auditor and client) for the audit report discussion draft.
Our principal product is the final report in which we express our opinions, present the audit findings, and action to be taken for improvements. To facilitate communication and ensure that the final report is practical, Internal Audit and Management Services will discuss the rough draft with the client prior to issuing the final report.
At the conclusion of field work, the auditor drafts the report. Audit management thoroughly reviews the audit working papers and the discussion draft before it is presented to the client for comment. This discussion draft is prepared for the unit's operating management and is submitted for the client's review before the exit conference.
When audit management has approved the discussion draft, Internal Audit and Management Services meets with the unit's management to discuss the findings and text of the draft. At this meeting, the client comments on the draft, and the group works to reach an agreement on the audit findings.
The auditor then prepares a formal draft, taking into account any revisions resulting from the exit conference and other discussions. When the changes have been reviewed by audit management and the client, the final report is issued.
The first page of the draft report is a letter requesting the client's review and responses to the report. In some cases, managers may choose to respond with a decision not to implement action to be taken and to accept the risks associated with an audit finding. Responses are then incorporated into the Final Report.
Internal Audit and Management Services prints and distributes the final report to the unit's operating management, the unit's reporting supervisor, the Senior Vice President and other appropriate members of senior University management. This report is primarily for internal University management use. The approval of the Internal Audit and Management Services Director is required for release of the report outside of the University.
Finally, as part of the Department's self-evaluation program, we ask clients to comment on the Department's performance. This feedback should prove to be very beneficial to us, and we can make changes in our procedures as a result of clients' suggestions.
Within approximately one year of the final report, the Department will perform a follow-up review to verify the resolution of the report findings.
The review will conclude with a follow-up report which lists the actions taken by the client to resolve the original report findings. Unresolved findings will also appear in the follow-up report and will include a brief description of the finding, additional action to be taken, current condition, and the continued exposure to the University. A discussion draft of each report with unresolved findings is circulated to the client before the report is issued. The follow-up review will be circulated to the original report recipients and other University officials as deemed appropriate.
In addition to the distribution discussed earlier, the contents of the audit report and follow-up report are also communicated to the University Board of Visitors'Audit Committee upon issuance of the Final Report.
As we have pointed out, during each stage in the audit process -- preliminary review, field work, audit reports, and follow-up -- clients have the opportunity to participate. There is no doubt that the process works best when client management and Internal Audit and Management Services have a solid working relationship based on clear and continuing communication.
Many clients extend this working relationship beyond the particular audit. Once we have worked with them on a project, we have an understanding of the unique characteristics of their unit's operations. As a result, we can help evaluate the feasibility of making further changes or modifications in their operations.