Audit Process

1. The audit is announced through an engagement letter.

• Internal Audit notifies the unit in writing when his or her area is selected for an audit. This document, which is referred to as an engagement letter, indicates general objectives of the audit, the projected time frame of the audit and information the client will need to supply.

2. An entrance conference is scheduled.

• An entrance conference is scheduled with the unit head to discuss the purpose, scope, and process of the audit.
• The Internal Auditor attends the entrance conference with personnel deemed appropriate by the unit head.
• Attendees are encouraged to present any questions or concerns they have about the audit.
• Unit heads may request that a specific function or area of their office be examined during the review or in future work.

3. A preliminary survey is performed.

• During this portion of the audit, the Internal Auditor will gain an understanding of the unit's business, procedures, objectives, size, etc.
• Written policies and procedures, organizational charts, related forms and job descriptions enable the auditor to plan the audit tests to be performed and to become familiar with the unit's operations.
• Internal controls are reviewed and documented during this portion of the audit.

4. Fieldwork is conducted.

• This phase of the audit includes testing the internal controls and performing other audit procedures necessary to accomplish the objectives of the audit.
• The unit head is notified of any potential audit observations and recommendations through status meetings.

5. Exit Conference is held.

• An exit conference is scheduled for the last day of fieldwork.
• The Internal Auditor presents a summary of observations and gathers cause statements from management.
• Further, it is an opportunity to discuss the audit observations and clarify any ambiguities.

6. A draft audit report is completed.

• Internal Audit's goal is to complete the audit and issue a draft audit report within 30 days after the completion of fieldwork.
• The draft audit report is prepared from the summary of observations presented at the exit conference.
• A written response to the draft report is required within 3 weeks of receiving the draft report.
• Management's responses must include the unit's plan for corrective action, the name and title of the person responsible for implementing the corrective action and the date by which the action will be implemented.

7. The final report is issued.

• The final report is issued to the unit head, appropriate supervisors, the University President, and the Chief Audit Officer and Associate Vice Chancellor at the Board of Regents.

8. A follow-up review is conducted.

• The unit head is expected to notify Internal Audit within 90 days of report issue upon implementing audit recommendations or other adequate controls, as justified. Internal Audit will review implemented corrective actions and clear audit observation(s).
• Internal Audit will submit a quarterly status report with new and open observations to the University President and Associate Vice Chancellor for Internal Audits.