Business Manual logo

THE AUDIT PROCESS

Internal Audit Section (AUD)

PROCEDURE 1

Effective Date: 07/01/1996

Last Modified Date: 06/03/2004

Procedure Summary

Once scheduled, Internal Audit (IA) projects generally consist of the following phases:

The exact approach may vary based on the lead auditor's familiarity with the area being reviewed or on the objectives selected for the project. In some cases, it may be possible to limit the time spent on one or more of the phases or to perform phases concurrently.

Procedure Steps

Scheduling

Areas are selected for routine audits using the risk assessment and long-range planning process described in AUD Policy 2, Risk Assessment and Long-Range Audit Plan. The timing of individual audits is based on the sensitivity and significance of an area as well as on workloads and staff schedules in an area. IA's four-year plan and annual work schedules will be made available to management. To the extent possible, IA attempts to adjust the timing of audits to allow for unexpected changes in an area's operations.

Approximately three to four weeks before a project is scheduled to begin, a member of the audit staff will contact auditee management to notify them of the review, schedule an entrance meeting (see Preliminary Survey, below), and begin the exchange of information that will be needed in the audit. This phone call is confirmed with a memorandum summarizing the initial discussion and identifying any information or documents that will be needed early in the project. The memo is addressed to the head of the unit or function being audited. Copies are sent to the appropriate Vice Provost or Vice Chancellor and other members of management who may be affected by the audit.

Preliminary Survey

During this phase, an auditor becomes familiar with the mission and primary activities of an organizational unit or function being audited. The purpose of this phase is to identify areas where IA can provide analyses and recommendations that will benefit the auditee or the University as a whole. Information reviewed during this phase helps develop the focus of and specific objectives for an audit.

The purpose of the entrance meeting is to open the channels of communication that are essential to a successful audit. During this meeting, the audit team explains the audit process, discusses the expected time frame for the review, and identifies management's suggestions for objectives. The meeting also allows arrangements to be made for audit work space in or near the auditee offices so that the project can proceed as efficiently as possible.

Based on the review of background information and discussion at the entrance meeting, the audit team selects final objectives for the review. Except in unusual circumstances, these objectives will include at least one item suggested by management. Final audit objectives are presented to the auditee and other members of management affected by the audit in a memorandum.

Review of Internal Controls

The system of internal controls is the plan of organization and processes adopted by an organization to safeguard its assets, check the accuracy and reliability of its accounting data, promote operational efficiency, and encourage compliance with established policies and procedures.

The extensive study and analysis of internal controls are features that distinguish an internal audit from an external audit of financial statements. Internal auditors provide an opinion on the quality of operations in an area or on processes used to produce financial statements, whereas an external audit opinion focuses on the fairness, consistency, and propriety of the financial statements produced by these processes.

A study of internal controls includes identifying the purpose of an activity and determining how it works. An analysis of controls includes identifying potential risks (i.e., what can go wrong), identifying ways to protect against those risks, and determining whether those features are part of the activity under review (strengths). This analysis also seeks to identify any weak or duplicative control features and to determine whether unnecessary steps are being performed.

At the end of this phase, the auditors will draw conclusions about the adequacy of control systems in the activities reviewed. That is, do the control systems contain the checks, balances, and procedures needed to ensure that management's objectives for these activities will be carried out?

Fieldwork

During fieldwork, auditors test documents and perform other procedures to determine if the strengths identified during the review of internal controls are in effect. Another purpose of fieldwork is to assess the possible impact of weak or missing controls. At the end of this phase, auditors will draw conclusions about whether the system of internal controls is operating as intended.

Communicating Results

Auditors will keep management informed of how an audit is progressing and will discuss possible findings and recommendations as these are identified during a review. This practice helps ensure that the results of the audit are accurate. It also promotes a team approach by actively involving management in developing solutions to issues identified by the audit. Early discussion of findings allows management to promptly begin any corrective action that is needed.

Audit findings will be summarized in writing, with "point sheets" and copies given to management during the audit. Since only the most significant findings will be included in the audit report, point sheets provide management with a complete record of the results of the audit.

The results of the audit will also be presented in a written report addressed to the Chancellor of the University, with copies provided to appropriate members of management. Refer to AUD Procedure 2, Audit Reports and Management Responses, for information about written audit reports.

Return to Internal Audit Section Contents

Return to Business Manual Table of Contents