What to Expect During an Audit
We consider our audits and reviews to be a collaborative process between the department and Internal Audit and Advisory Services. Our process is flexible and allows for the application of professional judgment based on each individual project. The information below provides an explanation of the steps taken during each phase of a project.
- Introductory Meeting: We will contact you to schedule an introductory meeting to discuss any concerns you may have and any areas or business functions that you would like us to review. During the meeting, we will discuss the potential time frame for the review, the audit objectives, and the audit logistics (facilities, availability of personnel, primary contacts, etc.).
- Department Surveys: After the introductory meeting, we will distribute a survey to the primary contact to obtain information that provides a comprehensive overview of the department. This will help determine the key areas to focus on during the audit.
- Planning & Scoping: Each audit engagement begins with a research phase during which we identify areas of risk by reviewing any past audit work, available information on the department, and departmental income and expenses. This phase requires limited departmental involvement since we have access to independently gather information from SAP and other applicable University systems.
- Fieldwork: During this phase, the audit staff performs detailed reviews of identified risk areas, department processes, and transactions. This includes interviewing key personnel and reviewing financial and budgeting activity, administrative and business procedures, critical departmental functions, information technology, and other activities specific to each department. We will keep you informed of our progress and will discuss risks and concerns with you as they are identified.
- Draft Report: After the fieldwork is completed and concerns have been reviewed with you, we will first prepare a draft report. The draft report is transmitted to you, the report addressee and process owner, for review and to help prepare your management response. Please discuss with your supervisor(s) regarding the level of engagement or consultation that he or she expects during the reporting process.
- Management Response: Responses typically include action plans to improve processes or mitigate identified risks, the parties responsible for carrying out the action plan, and the expected date of action plan completion.
- Closing Meeting: The draft report is updated to reflect feedback you provide after reviewing our audit report. The closing meeting provides an opportunity to discuss and gain consensus on the wording of issues and recommendations in the draft report, and to agree on feasible management action plans and reasonable completion dates.
- Report Distribution: The final report is delivered to the appropriate parties in your team and the organizational reporting line. You will be given the opportunity to review the final report before distribution to the appropriate senior management. (Refer to FAQ – “Who Receives The Audit Report?”)
- Client Surveys: Web-based audit surveys are distributed approximately 1 week after the final report has been distributed to solicit feedback about the audit. This feedback is important as we seek to continuously improve our service delivery.
For audit reports that contain issues that require corrective actions, management will formulate action plans. The issue coordinator is expected to complete the action plan by the agreed-upon completion date. Two weeks prior to the expected completion date, we will notify the issue coordinator that a management action plan is approaching the due date and request that the coordinator provide us with updates and information to demonstrate completion.
We will review the information provided by the issue coordinator and determine whether the issue is resolved. If the management action plan has been appropriately implemented, we will document that it is complete. If it requires additional measures for completion, we will work with the issue coordinator to take the necessary steps or obtain the appropriate documentation to resolve the issue. We are required to report on complete and incomplete management action plans to the Audit Committee.