Effective Date:  12/09/2004

Internal Audit Polices and Procedures


Chapter 16 - Communicating Results



 General

IIA Standard 2400 gives requirements and guidelines for communicating the results of audit work.  This section of the audit manual describes our approach to communicating the results of audit projects.

Except for very small reviews, we will issue some form of written communication at the end of each project.  The structure and content of this communication will be based on the nature and results of a project and what we need to communicate with whom.  Results of small reviews can sometimes be communicated orally.

Regardless of the format, written communications (reports) should possess certain basic qualities.  They should be:

    Objective - present information in a factual, unbiased manner.
   
    Constructive - focus on ways to help the auditee and lead to improvement rather than criticizing errors and control weaknesses.
   
    Clear - be logical and easily understood, avoid unnecessary technical language, and provide appropriate supporting information.
   
    Concise - be to the point, avoid unnecessary detail, and express thoughts in the fewest possible words.  Generally, the first sentence of a paragraph in a report or close out letter should identify the problem noted or the basic nature of a recommendation.


The choice of words used and tone of reports are as important as the information presented.  For example, if we find a missing process - such as daily deposit of receipts - it’s better to say that the missing process is required by University policy instead of describing its absence as a violation of policy.  Using neutral words increases the likelihood that management will provide an acceptable response and take appropriate corrective action.  When writing reports, be guided by how the language used would sound to you if you were the manager of the area reviewed.

Findings, recommendations, and management’s responses in our reports should never identify individuals by name.  Identifying someone using a position title or general terms such as “an employee” or “ the individual named in the complaint” preserves objectivity and reduces potential legal liability for the University and the author of the report.

Reports are typically addressed to the Chancellor with copies provided to members of management who are responsible for the area audited or who can correct any of the findings reported.  However, close out letters for special projects may be addressed to the manager who requested the project and copied to the Chancellor if review was straight-forward and no major weaknesses were noted.

Until the final report is issued, all pages of the reports should be clearly marked “Draft - For Discussion Purposes, Only.”


Formal Reports

A formal report format should be used for routine audits, major special projects, and major misuse investigations.  Formal reports consist of a title page; contents page; an executive summary; a background section; if appropriate, findings, recommendations, and management’s responses; and identify the individual who provided management’s responses.  Refer to Attachment C for a sample of the formal audit report format and details about its structure.


Close out Letters

The results of smaller special projects and misuse investigations will be communicated with a close out letter that summarizes the allegation reviewed or nature of a special project and the results of our review.

If the findings from a misuse investigation or special project cannot be adequately disclosed with a general statement or we need to obtain management’s responses to the findings, we will issue a close out letter accompanied by a Findings and Recommendations section like that of a formal audit report.

Some special projects may require a formal report for significant findings and a separate memo to department management listing less significant issues.

Refer to Attachment D for an example of a close-out letter.


Management’s Responses

Whenever our reports present individual findings, we should obtain management’s response to the findings.  These responses will be included in the report immediately after the related finding and recommendation.

The auditor who conducted the review is responsible for determining that the responses are adequate, complete, and address the issues in the report.  Responses should state whether or not management agrees with the finding.  The responses should state whether they will implement the corrective action suggested in the recommendation or describe alternative steps they will take to address the underlying issue.  Responses identify the positions that will be responsible for making the corrections and the estimated date that corrective action will be complete.

If management disagrees with a finding or provides an inadequate response, the auditor in charge should work to resolve the situation.  As a first step, the auditor should contact the individual to exchange additional information about the issues.  If the auditee disagrees with the finding, the auditor should obtain and review additional information that supports the auditees’ position and, if necessary, provide additional details that support the finding.  If the response is incomplete, the auditor should explain what changes are needed and ask that these be made.

If discussions with the auditee do not resolve the problem, the in-charge auditor and the Director of Internal Audit will work with each successive level of management to try to resolve the conflict.

We should not issue a report with the facts of a finding in dispute.  Auditee management may disagree with the significance of an issue in a report, may prefer an alternative solution to the one suggested in our recommendation, and may even decline to take corrective action.  However, any finding in our reports should contain accurate, complete information and management’s response should be clear about the exact nature of any disagreement.

If we are unable to resolve a disagreement about the significance of a finding or about the need for or adequacy of corrective action, we will include the auditee’s views in the report.  If management has declined to take appropriate corrective action, our report should disclose that senior management has been informed of the risk of not taking corrective action and has accepted that risk.  In both cases, all levels of auditee management should be given an opportunity to review the revised report.


Review of Draft Reports

When we have received final responses from the auditees and included them in the report, we will forward a draft version of the report to each successive level of management responsible for the area audited for review and comment.  If upper management makes any significant changes to the response, we should - as a courtesy - provide a copy of the revised response to managers who have previously reviewed the report.  After the draft report has been reviewed by the Executive Vice-Chancellor or the Provost, as appropriate, we can issue the final report to the Chancellor or alternative recipient.


Assigning Report Numbers

When a final report or close-out letter is ready to issue, the Office Assistant assigns a report number from the report master file (in a metal index card box kept in the reception area of the Audit offices. 

A report number is a sequential number that distinguishes between scheduled audits and special projects/misuse investigations.  Scheduled audits are assigned a 3-digit number.  Special projects/misuse investigations are assigned a 3-digit number, prefixed by X-.  

The report number for scheduled audits is included on the title page of the report.  For special projects/misuse investigations, the report number is written in the top right corner of the file copies of the close-out letter after it is issued to management.


Links to see the format of Findings Database Report Entry Form (Attachment A in the UNC Internal Audit Policies and Procedures Manual, Chapter 16) and the Findings Database Entry Form (Attachment B in the UNC Internal Audit Policies and Procedures Manual, Chapter 16).






Effective Date:  12/09/2004

Internal Audit Polices and Procedures


Chapter 16 - Attachment C - Regular Audit Report


                                                                                                        date issued 1



                    Dr. Michael K. Hooker, Chancellor 2
                    103 South Building
                    Campus Box 9100

                    Dear Dr. Hooker:

I have enclosed the report from our recently completed audit of (name of area).  Please call me if you have any questions about the review or report.

                                                                                                                                                       Sincerely,



                                                                                                                                                        Phyllis C. Petree
                                                                                                                                                        Director of Internal Audit





                    Attachment
 


page break





                            University of North Carolina at Chapel Hill  










                                                                                                                                                         Audit name,   
                                                                                                                                                          audit #, &   
                                                                                                                                                     date issued go here
                                                                                                                                                        (approximately)




                                                                                    Distribution of Final Report 4

                                chancellor                                                                                        appropriate dean(s) or
                                executive vice-chancellor or provost                                                    associate vice-chancellor(s)
                                appropriate vice-chancellor(s)                                                          appropriate department head(s)
                                                    other members of management who are in positions to correct findings
 

page break


    Contents5

       Section                                                                                                      Page  6

Executive Summary ............................................................................................. 1

Background ....................................................................................................... 2

Findings and Recommendations

   Heading of First Finding..................................................................................... 3

   Heading of Second Finding................................................................................. X

   etc.


page break



Executive Summary  7

We have completed an audit of (name of area) for (audit period).  The objectives of our audit were to determine if controls in (area) were sufficient to ensure that 8  assets were properly safeguarded from loss, etc. 9

                                            MAY NEED TO PUT OBJECTIVES IN BULLET LIST   10

Based on our review, we conclude that operations were generally satisfactory.  However, we noted areas where efficiency could be improved.  Issues that led to this conclusion include: 11

  • Lack of controls to ensure that all costs were accounted for and properly billed; and
  • Untimely deposit of funds received.

Details relating to these issues and specific recommendations to address them are found in the section of the Report titled Findings and Recommendations.

                                                                                            Sincerely,  12



                                                                                                                                                       (name)
                                                                                                                                                       Director of Internal Audit


                                                                                    (name)
                                                                                                                                                      Auditor

page break

Background  13

SUMMARY OF WHAT AREA DOES, APPROXIMATE. REVENUE & EXPENDITURES DURING AUDIT PERIOD, MAYBE NUMBER OF EMPLOYEES OR STUDENTS. EXCEPT IN UNUSUAL CASES, SHOULD BE NO MORE THAT HALF A PAGE LONG.

INTENDED TO GIVE READER A FEEL FOR WHAT THE AREA DOES AND HOW IT COMPARES IN SIZE TO THE REST OF THE UNIVERSITY.

EVENTUALLY, WE WILL ALSO SAY THAT WE CONDUCTED THIS PROJECT IN KEEPING WITH THE STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING ISSUE BY THE IIA.


page break


Findings and Recommendations  14


PUT FINDINGS & RECOMMENDATION IN ORDER OF SIGNIFICANCE

Title of Finding  15

Text of finding

        Recommendation:  Text of recommendation 16 

                Management’s Response: 17   Text of management’s response.


Individuals Providing Responses:  (name & title) provided management’s responses to this report.  The complete report has been reviewed by appropriate members of University management.


page break



Effective Date:  01/12/1999

Internal Audit Polices and Procedures

Chapter 16 - Attachment D - Close-out Letter for Misuse

Reviews and Special Projects with Major Findings


                                                                                                                                                date issued18



Ms. Laurie T. Charest19 
Associate Vice Chancellor for Human Resources
300 South Building
Campus Box 1000

Dear Ms. Charest:

We have completed a review of financial records and reports for the (area reviewed).  We performed this review at your request after questions were raised about the accuracy of financial information reported for in 1993 and 1994.  These questions were presented in a letter to the Chancellor, dated January 17, 1997.  The purpose of our review was to obtain answers to these questions and to determine what additional ac-tion, if any, was needed.20 

Our review consisted of interviews with _________ and _____________.  We also examined and tested supporting financial records for the (area), analyzed procedures for maintaining records and preparing fi-nancial reports, and reconstructed financial statements for camp years 1992 through 1996, using informa-tion contained in the University’s Financial Records System (FRS).21  

Based on the procedures we performed, we found no evidence that the (area’s) financial statements con-tained irregularities.  However, we determined that there were errors in the 1993 and 1994 statements.  It appears that these errors occurred due to a lack of training in or written instructions for financial statement preparation and because the (area’s) operations crossed two fiscal years for the University:22

  1. In 1993, revenue was reported correctly but expenditures were overstated.  The difference in expendi-tures occurred because a $2300 payment for services by a UNC faculty member was reported twice - once as a part of salaries for directors and counselors and again as a separate salary item.  The 1993 report also listed an expense, approximately $6600, for a portion of the salary of an individual who performed administrative duties for the (area).  While administrative services were provided, the indi-vidual’s salary and benefits were paid from another University account and should not have been rec-ognized as an expense on the (area’s) financial statement.
  2. Revenue for 1994 was understated by approximately $970 due to the omission of income received be-tween November 1993 and January 1994, late payments for the 1993 sessions.  Expenditures for 1994 were understated by approximately $10,100 because payments made prior to July 1, 1994, when the University’s fiscal year changed, were omitted from the report.
  3. Because of the errors noted above, the ending balance on the 1993 statement and the beginning balance on the 1994 statement were not in agreement with the University’s Financial Records System (FRS).
   
We also noted that record-keeping practices for the (area) needed to be improved.  Details of these issues, specific recommendations to address them, and management’s responses to the findings are given in the attached report.

We conclude that no further work by our office is necessary at this time but will follow-up on these issues during our annual, University-wide review of previously issued audit findings.23   If you have any questions about our review or recommendations, please call me at 962-5524.

Sincerely,



Phyllis C. Petree
Director of Internal Audit


c:    chancellor24 
       executive vice-chancellor or provost
       appropriate vice-chancellor
       appropriate associate vice-chancellor or dean
       appropriate department head
       other members of management as appropriate
 

page break



Findings and Recommendations25

Prior Year Financial Statements

Our review showed that income and expenses reports for 1993 and 1994, as published, were not accurate.  The differences noted appeared to have been caused by a lack of training in or written instructions for financial statement preparation.  The net effect of the differences noted for the 1993-94 biennium was that revenue and expenditures were understated by approximately 1% and 10%, respectively.  These errors resulted in an incorrect ending balance for the 1993 report and an incorrect beginning balance for the 1994 report.

Recommendation:  The income and expense reports for 1993 and 1994 should be corrected and re-issued.  The reissued statements should present operating results as originally reported, identify ad-justments needed to correct the original statements, then present operating results as corrected.  At-tachments A and B show Internal Audit’s estimates of restated operating results for 1993 and 1994.

Management’s Response:  The 1993 and 1994 income and expense reports will be corrected and reissued by April 1, 1997.

Responsibility for producing financial statements for the (area) has been reassigned.  Careful train-ing will be provided to this individual in order to fully comply with these recommendations.


Fiscal Year and Basis of Accounting

Although the annual report was prepared and presented in early November of each year, the time frame covered by the financial statements was not consistent.  In some cases, transactions posting in November, December, or January were included in the operating results of the prior year.  In other cases, they were not reported at all.  Similarly, statements and other financial records were sometimes prepared on a cash basis and at other times on an accrual basis of accounting.
   
Recommendation:  Management should establish an official fiscal year and observe this year for re-cord-keeping and reporting purposes.  The fiscal year chosen should be based on the (area’s) “busi-ness cycle,” the timing of budget preparation, and the need to issue financial reports.

We also recommend that the (area) use the cash basis of accounting.  That is, financial statements will only include income that has been received and payments that have been made during the time frame covered by the statements.  Footnotes to the statements should be used to identify revenue or expen-ditures that are in transit but will not be recorded until after the end of the fiscal year.  Transactions that occur in one fiscal year but relate to a prior year, should be reported either as an adjustment to the beginning balance or as a revenue or expenditure item identified as belonging to a prior fiscal year.

To improve the quality of information presented in the annual report, we recommend that financial statements be prepared in a format that shows budgeted and actual amounts for the current year or that presents the results of the current year and one prior year of operations.

Management’s Response:  The official fiscal year will be established as January 1 to December 31.  This cycle should allow most expenses to clear prior to year end.  Financial reports can be de-livered to the __________________ in January. 
   
The (area) will begin to use the cash basis for accounting effective with the current fiscal year.  Footnotes will be used as suggested.  Comparative presentation of budgeted and actual results has been implemented.
   

Recordkeeping Practices

We were unable to locate supporting schedules showing how amounts reported on the financial statements were calculated.  Also, income and expenditures were not described or grouped consistently and did not match classifications from the University’s accounting system.

We also noted that records relating to fees receivable needed to be strengthened.  While improvements have been made in these records since 1994, restructuring and reformatting these records will facilitate identifying amounts due, unpaid balances, and any refunds that may be needed. 
   
Recommendations:  Prepare and retain schedules showing how the information reported in financial statements was determined.  The easiest way to accomplish this may be to obtain a report directly from FRS that lists the balance available on the first day of the fiscal year, all transactions occurring in the (area’s) account during the fiscal year, and the ending balance available on the last day of the fiscal year.  The information on the financial statements should be in agreement with the FRS report.  The Financial Systems office can assist with obtaining these FRS reports.
   
Revenue and expenditure categories shown on the financial statements should match those on the Univer-sity’s accounting system.  If any categories are combined, this information should be noted on the supporting schedules.

The summary record of fees receivable should list the following items: name (in alphabetical order): number of sessions attended; total fees due; any financial aid received; payments made; and balance due.  This record should also note the date that fees were paid in full.  A purchased software pack-age is one option for enhancing receivables records or these records may be developed using spread-sheet or database software.

Management’s Response:  Schedules showing how information reported in financial state-ments was determined will be prepared and retained.  We will work with the Financial Systems office to get the needed FRS reports.  Revenue and expenditure categories will match those of the University’s accounting system, unless otherwise noted. 

A summary record of fee’s receivable will be available.  Work is already underway with Ad-ministrative Information Systems to develop a Microsoft Access system to provide the needed receivables records.


Individuals Providing Responses:  (name & title) provided responses to the findings and recommenda-tions in this report.  The report and responses have been reviewed by appropriate members of senior management.


page break


                                                                                                                                    November 6, 199626

Dr. Michael Hooker, Chancellor27 
103 South Building
Campus Box 9100

Dear Dr. Hooker:

We have completed a review in the (name of area).  We initiated our review in response to an anonymous letter alleging misuse of funds and work time in that Department.  Our review included an examination of financial reports and documents and interviews with management of the Department.  We referred allega-tions involving misuse of time to the Office of Human Resources for resolution.

Our review showed that employees of the Department have sometimes used a University Federal Express account to ship personal items.  The practice was infrequent and the individual had reimbursed the De-partment for the cost of the shipments.  We also noted that long-distance calls with no apparent business purpose (e.g. calls to a veterinarian, dentist, cycling shop, local medical center, etc.) had been charged to Department phones; none of the calls had been reimbursed to the University.  Neither practice is in keep-ing with policy regarding personal use of University facilities and resources.  We discussed these items with Department management; appropriate corrective action is underway.28 

We will follow-up on this issue in any future reviews in the (name of area) and will advise you if any ad-ditional action by our office is necessary.  If you have any questions about our review, please call me at 962-5524.

Sincerely,



Phyllis C. Petree
Director of Internal Audit

c:    executive level (Provost or Executive Vice Chancellor)29  
       vice chancellor
       dean or associate vice chancellor
       department head


footnotes follow:


  1. Date is typed 7 lines down from top of page with 1” margin at top.
  2. Formal reports are addressed to the Chancellor.  Report is typed using the CG Times or Times New Roman font and, unless otherwise noted, 11-point type.
  3. 14-point type.
  4. Members of management who oversee an area affected by the audit or who have the ability to resolve an issue addressed in the report.  The Senior Legal Counsel should be included in the distribution for reports from misuse investigations.  The Chief of the UNC Police and the Associate Vice Chancellor for Finance should receive a copy of reports from misuse investigations reported to the SBI.
  5. One inch margin at top of page, 14-point type, bold, and underlined.
  6. “Section” and “Page” are 11 point type, bold, and underlined.
  7. See footnote #4.
  8. Wording shows that the purpose of our review was to determine if controls or processes will allow the area to meet its goals and responsibilities.  If we stated that the purpose of our review was to ensure that, for example, assets were properly safeguarded from loss, rather than determining if controls should accomplish this objective, we imply that we have done something that is actually management’s responsibility.
  9. Identifies the scope and timeframe of the project.
  10. If there are three or more objectives for an audit, a bullet list is preferable.
  11. The opinion should be stated in overall terms and should be in keeping with the objectives of the review.  Opinions can also be mixed - satisfactory for some objectives, need for improvement relating to others.  Major items that led to the opinion should be identified in very general terms.
  12. Reports are signed by the Director and the auditor who conducted the review.
  13. See footnote #4.
  14. See footnote #4.
  15. Title of Finding is bold and underlined and should identify the audit area addressed in the finding, e.g. “Policies and Procedures” or “Accounts Receivable Records” but not what is wrong.  First sentence of finding should identify the problem.  Unless the weakness is self-explanatory, the finding should identify what can go wrong as a result of the weakness noted.
  16. “Recommendation” is bold and underlined.  First sentence of recommendation paragraphs should state proposed solution(s).  If necessary, give benefits of making the suggested change.
  17. “Management’s Response” and “Individuals Providing Responses” are bold and underlined.
  18. See footnote #1.
  19. Close out letters may be addressed to the Chancellor or to the member of management who requested the review depending on the size and results of the project.  Close out letters relating to allegations of misuse reported to the SBI should be addressed to the Chancellor.
  20. Identifies the scope, purpose, and timeframe of the project.
  21. Identifies basic audit approach.  Use to disclose any scope limitations in a limited review.
  22. The opinion should be stated in overall terms and should be in keeping with the objectives of the review.  Opinions can also be mixed - satisfactory for some objectives, need for improvement relating to others.
  23. Disclose any need for continuing review.
  24. See footnote #3.
  25. See footnote #4.
  26. See footnote #1.
  27. Close out letters may be addressed to the Chancellor or to the member of management who requested the review depending on the size and results of the project.  Close out letters relating to allegations of misuse reported to the SBI should be addressed to the Chancellor.
  28. State results and conclusion in general terms.  Provide enough details to inform but don’t over-disclose.  Respect the rights of individuals who may have been involved in the review.
  29. See footnote #3.