Internal Audit Section (AUD)

PROCEDURE 2

Effective Date: 07/01/1996

Last Modified Date: 02/10/1997

Procedure Summary

After all analyses and testing for a project are complete and any potential findings have been discussed with management, Internal Audit (IA) will issue a report that describes the results of the project. Written reports will contain only the most significant findings from a review. Other issues will be presented to management orally or in writing during the project. Every effort will be made to make reports objective, clear, concise, and constructive both in content and tone.

All audit reports consist of the following sections:

• Executive Summary—This section states the objectives of the audit and gives an overall opinion about the control systems reviewed. If the opinion is other than satisfactory, e.g., if certain controls needed to be improved, this section briefly states issues that led to the opinion and refers the reader to a section of the report where more detailed information is available.
• Background—This section identifies the mission and major activities of the area audited and the period covered by the audit. Other information that may help the reader to better understand the area and the significance of items in the audit report—such as revenue and expenditures, number of students or employees, and major sources of funding—can be found in this section.
• Findings and Recommendations—This section lists, in descending order of significance, the major issues noted in the audit. Each finding will be followed by a recommendation for steps to address the issue, and by management's response to the auditor's comments.
• Individuals Providing Responses—This section gives the names and titles of individuals who prepared management's responses.

Reports will be signed by the Director of Internal Audit and by the staff member who performed the review.

Procedure Steps

1. Initial Draft Reports

Audit reports are initially issued in draft form. Reports will be marked "Draft—For Discussion Purposes Only" until the final version is sent to the Chancellor.

The first draft of a report is sent to management of the area audited and to other individuals who need to provide a written response to report comments. After these individuals have reviewed the report, they will have the opportunity to meet with IA to discuss the report. Once the wording and content of the report have been agreed upon, management will provide a written response to the findings and recommendations in the report.

2. Management's Responses

Management's responses will be included in the body of the report, immediately after the related finding and recommendation.

1. Each response should state whether management agrees with the finding. The response should also indicate whether management will implement corrective action suggested in IA's recommendation, or else describe alternative steps that will be taken to address issues that led to the finding. The response should also include an estimate of the date when corrective action will be complete.
2. IA will review these responses to determine if the action proposed will correct the issues described in each finding and the time frame for corrective action is reasonable.
3. If a disagreement over findings or recommendations arises between auditors and management, every effort will be made to resolve the disagreement during the audit. Generally, this can be accomplished through discussion and exchange of additional information. If the disagreement cannot be resolved at the department level, IA will refer both sides of the issue to all necessary levels of senior management for review and resolution.
4. If management disagrees with a report recommendation, they may propose an alternative solution. If management declines to take appropriate corrective action, and the issue cannot be resolved through the process described above, then management's response ("declining action") will be included in the report. The response will be followed by a statement from IA identifying the risks associated with allowing the situation to continue and stating that, by declining to take action, management has accepted these risks.

3. Subsequent Drafts

After management's responses have been obtained and reviewed, they will be included in the report. This second version of the draft report is sent to each level of management responsible for the area audited. Each level of management will have the opportunity to review the report and meet with IA to discuss the report and the results of the audit.

4. Final Report

After the draft report has been reviewed by appropriate members of senior management, the final version of the report is issued to the Chancellor of the University. Copies of the final report are also provided to the following:

• management of the area audited and any areas that will assist with corrective action;
• senior managers responsible for areas affected by the audited (e.g., Vice Chancellor or Vice Provost, Dean, Associate Dean, etc.);
• the Associate Vice Chancellor for Finance;
• the Executive Vice Chancellor; and
• other members of management who are in a position to ensure that any necessary changes are made, as appropriate.

Return to Internal Audit Section Contents

Return to Business Manual Table of Contents