There are primarily three reasons that an area is selected for audit: (1) annual audit schedule; (2) requests by DSU administration (president, cabinet and department heads); and (3) requests by DSU administration based on information provided by employees, students, and outside parties.
Each year, the Office of the Internal Audit prepares a three year rolling IHL approved audit plan. The schedule is planned in detail, based upon the number of available working hours in the coming year and the anticipated hours required for the performance of each scheduled audit and administrative request. In addition, internal audit will prioritize the audit plan based on internal and external risks associated with each area on campus, as well as, the last time an evaluation was performed.
What occurs on a routine audit?
I. Audit Scheduling
Although a common courtesy, the Office of the Internal Auditor is not required to give notice prior to performing an audit. In cases where notice will be given, the Internal Auditor will contact the management of the area to schedule a beginning date for the audit. Prior to the beginning date, the Internal Auditor will schedule an entrance conference with the manager and other personnel whom the manager and auditor consider appropriate. If scheduling problems arise, the Internal Auditor should be notified immediately.
II. Audit Planning
The auditor assigned to conduct the examination will review the files of prior audits (if any), review applicable professional literature, research any applicable policies or statutes, and prepare an audit program.
The program details the tests and procedures required for each step of the audit. Audit work papers will provide evidence of completion of specific audit program steps and support of audit findings.
III. Entrance Conference
At this meeting, the managers and other personnel of the area to be audited and personnel from the Office of the Internal Audit will discuss the purpose and scope of the audit, the audit program, and the audit reporting procedures. Any special concerns of the department should also be discussed during this time to be included in the audit program.
IV. Audit Program
Based upon the information obtained during the entrance conference, the audit program may be adjusted. It is also possible that the audit program may be modified during the course of the audit.
V. Fieldwork
The auditor’s performance of the planned audit program is referred to as fieldwork. The fieldwork will begin with a review of internal controls.
With the exception of first-time audits, when considerable audit testing is necessary, the scope and extent of testing may be reduced substantially when internal controls are considered strong.
The fieldwork will include testing (compliance, analytical, etc.) of various documents and departmental reports. Interviews may be held with employees within a department to inquire about their duties. Flowcharts of processes may be prepared to better understand the controls in place. Most work will be performed in the department being audited (if space permits). However, some audit work cannot be performed in the departments and will be completed in the auditor’s office.
During periods where the audit staff is working in the areas under review, the auditors will minimize their demand on the time of personnel, so that normal activities can be performed with minimal delays.
VI. Report Writing
Once the fieldwork has been completed, the auditor conducting the review will compile a draft report detailing the audit program performed, findings, and recommendations for improvement or corrective action. A copy of this report will be forwarded to the management of the area being evaluated for review regarding the accuracy of findings and the propriety of recommendations. The OIA will change any information within the report to correct inaccuracies. However, objective opinions stated in the report based upon accurate facts cannot be compromised. Administration expects and is entitled to an independent opinion. When there is a disagreement on the interpretation of the facts, the report will be amended to express the positions of both the internal auditor and the operating manager.
VII. Exit Conference
Internal Audit will meet with management of the area under review within ten business days of the date the draft report for the exit conference.
Usually, the same people who were present during the entrance conference will be present during the exit conference. The purpose of this meeting is to discuss the audit findings, recommendations, and the need for corrective action as documented in the draft report.
The auditor will request the department head to submit a written resolution of noted findings.
VIII. Department Response
A written response to the auditor’s draft report should be prepared. The response should outline the actions taken or to be taken to correct the deficiencies reported, and should be submitted to the OIA to be included in the final report. An adequate response to the auditor’s report is implementation of the auditor’s recommendations stated in the report, the implementation of alternative procedures that provide approximately the same degree of control as the auditor’s recommended procedures, or a statement explaining that management has assumed the risk of not taking corrective action on the reported findings.
The internal auditor will specify a reasonable date by which departmental responses should be submitted. If the department does not respond within the appropriate time frame, the final audit report will be issued noting the area under review had not provided a response.
IX. The Final Report
Once the department under examination reviews the draft report and submits a response to the OIA, the audit report is finalized and distributed.
The final report is distributed to the President, the appropriate Vice President, Dean (if applicable), and the department director of the area audited.
X. Audit Follow-up
If deemed necessary, the OIA will conduct follow-up reviews of the audited departments. The OIA shall determine that corrective action taken is achieving the desired results.
