Internal Audit Process
The audit process is fundamental to engaging in useful, meaningful, and productive audits that are of benefit to the university. The process consists of the following three phases:
The primary purpose of the planning phase is to determine audit scope and objectives, which serve to establish audit boundaries and identify specific areas under review.During the planning phase, the auditor conducts an Opening Conference to begin the audit. At the conference, the auditor communicates the audit scope and objectives, describes the audit process, and establishes a cooperative relationship with management.
The fieldwork phase consists of preliminary and detail phases, as follows:
- Preliminary Audit Phase – Based on the audit scope and objectives, the auditor develops a Preliminary Audit Program to fulfill the following objectives:
- Obtain a thorough understanding of the audit area by interviewing personnel and gathering, reviewing, and observing policies, procedures, and practices.
- Analyze business processes and develop system flow analyses.
- Evaluate customer service.
- Assess operational risks and evaluate internal controls.
During the preliminary phase, the manager directly responsible for the audit area is promptly consulted regarding potential audit concerns. Management is encouraged to provide additional information, clarification, and/or insight to aid the auditor in determining if an audit comment is warranted.
- Detail Test Audit Program – A Detail Test Program is developed to test areas of high risk identified during the Preliminary Phase. The main focus is on testing compliance with policies, procedures, laws, and regulations. Again, in the event an audit concern is identified, management is promptly notified and given an opportunity to provide insight regarding the issue at hand.
Upon completion of fieldwork, the auditor prepares a draft audit report. Those under review, up to the head of the area under review, are provided a copy of the draft report, and meetings are held as necessary to clarify issues and give management officials the opportunity to offer comments on or corrections to report content. After the draft report has been appropriately coordinated, it is submitted to management for formal responses to each issue. After the responses are received, they are incorporated verbatim into a final report that is distributed to all appropriate parties.