Effective Date:  12/03/2004

Internal Audit Polices and Procedures


Chapter 14 - Audit Follow Up Process

General

As required by the IIA's Standards for the Professional Practice of Internal Auditing (Performance Standard #2500), internal auditors “should establish a follow-up process to ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action.”  An annual review and Report of Outstanding Audit Comments has been adopted by the Internal Audit Department to meet the needs of UNC General Administration and University management and to comply the follow-up requirement noted above. 

To facilitate the follow-up process, Internal Audit maintains a database of outstanding audit comments.  This database tracks identifying information about each Internal Audit report or close-out letter along with a summary of each finding in the report or letter, the position responsible for taking corrective action, and the estimated completion date for corrective action.  Audit comments issued by external audit groups should be loaded into the database when they are received.  The database will also track whether or not a finding has been corrected, what was done to correct the issue, whether corrective actions should be tested, and the date corrective action was complete.

At the end of each project, the auditor in-charge completes a Report Entry Form for the project and a Finding Entry Form for each comment in the report or close-out letter.  Refer to Chapter 10 Finding Database Report Entry Form and Finding Database Finding Entry Form for a copies of these forms. Completed forms should be submitted to the Director of Internal Audit for review, then given to the Audit Assistant for entry into the database.

Follow-up Reviews

In most cases, follow-up reviews will be done as a University-wide project.  However, if requested by management, we may follow-up on the status of selected findings in a separate review.  Also as time is available during the year, we may send inquiries about and test the status of previously issued findings. Refer to Audit Follow Up Program for the audit program for departmental and university-wide follow-up reviews.

Approximately 3 to 4 weeks before testing in the annual follow-up is scheduled to begin, check the completeness of the Findings2000 database by printing the contents of the Reports table and comparing this information to the manual list of audit reports.  If any reports have not been entered into the database, have the in-charge of that audit complete the report and findings forms and have this information added to the database.  Once the database is confirmed as being current, update the queries and report programs that are used to create reports that will be used in the follow-up process.  See Follow-up Audit Program Section C - Planning and Preliminary Survey section – University Wide Follow-up for details.

The Director of Internal Audit or the auditor in charge of the follow-up review will prepare a memorandum for senior management that notifies them that audit activities are underway and describes the follow-up process.  This memo should include:

The Announce Memo report Findings2000 Access database provides sample wording for the notification memo.

The notification memo should be sent to each department head along with the Inquiry Forms – Status of Audit Findings for each finding related to the department head’s areas of responsibility.

As the findings status forms are returned to Internal Audit, the information should be reviewed for reasonableness, completeness and adequacy.  The in-charge will determine, with the approval of the Director, which of the responses need to be tested and what level of testing is appropriate.  Working papers and work programs should be generated and reviewed as with any other audit project.

At the conclusion of the testwork and after updating the Findings2000 database, reports of outstanding, or closed findings and a cover letter of explanation should be generated and distributed to the following groups allowing approximately 2 weeks for each group to review and respond:


        Department Heads – also receives list of report of Corrected Findings

Deans

Associate Vice Chancellors and Vice-Provosts

Executive Management

After each of these groups has reviewed the reports and any necessary corrections to the database have been made, the final versions of the Outstanding Findings report, the Repeat Findings report, and, if necessary, the Closed Findings report should be produced for the Chancellor and Board of Trustees and issued.

Return to Home Page Table of Contents