Audit Process
Preliminary Review
Fieldwork
Audit Report
Audit Follow-Up
Internal Audit Annual Report to the Board of Trustees
The Process: A Collaborative Effort
The most successful audit projects are those in which the client and Internal Audit
have a constructive working relationship.
Our objective is to have your continued involvement at every stage, so that you, our
client, understand what we are doing and why.
Audit Process
Although every audit project is unique, the audit process is similar for most
engagements and normally consists of four stages: Preliminary Review, Fieldwork, Audit
Report, and Follow-up Review. Your involvement is critical at each stage of the audit
process. As in any special project, an audit results in a certain amount of time being
diverted from your unit's usual routine. One of our key objectives is to minimize this
time and avoid disrupting your ongoing activities.
Top of Page
Preliminary Review
During the preliminary review portion of the audit, we
notify you of the audit, discuss the scope and objectives of the examination in
a formal meeting with your organization's management, gather information on your
important processes, evaluate existing controls, and plan the remaining audit
steps.
Announcement Letter
The client is informed of the audit through an
announcement letter from the Internal Audit Director. This letter communicates
the scope and objectives of the audit team assigned to the project.
Initial Meeting
During this meeting, the client describes the unit or system to be reviewed, the
organization, available resources (personnel, facilities, equipment, funds), and other
relevant information. The internal auditor meets with the senior officer directly
responsible for the unit under review and any staff members s/he wishes to include. It
is important that the client identify issues or areas of special concern that should be
addressed.
Preliminary Survey
In this phase the auditor gathers relevant information about the unit in order to
obtain a general overview of operations. S/He talks with key personnel and reviews
reports, files, and other sources of information.
Internal Control Review
The auditor will review the unit's internal control structure, a process which is
usually time-consuming. In doing this, the auditor uses a variety of tools and techniques
to gather and analyze information about the operation. The review of internal controls
helps the auditor determine the areas of highest risk and design tests to be performed in
the fieldwork section.
Audit Program
Preparation of the audit program concludes the preliminary review phase. This program
outlines the fieldwork necessary to achieve the audit objectives.
Top of Page
Fieldwork
The fieldwork concentrates on transaction testing and informal communications. It is
during this phase that the auditor determines whether the controls identified during the
preliminary review are operating properly and in the manner described by the client. The
fieldwork stage concludes with a list of significant findings from which the auditor will
prepare a draft of the audit report.
Transaction Testing
After completing the preliminary review, the auditor performs the procedures in the
audit program. These procedures usually test the major internal controls and the accuracy
and propriety of the transactions.
Advice & Informal Communications
As the fieldwork
progresses, the auditor discusses any significant findings with the client.
Hopefully, the client can offer insights and work with the auditor to determine
the best method of resolving the finding. These communications are usually by
e-mail. An audit observation form is sent via e-mail to ensure full
understanding by the client and the auditor of the potential finding. In the
response section on the form, the client should explain how findings will be
resolved and include an implementation timetable. Our goal: No surprises.
Audit Summary
Upon completion of the fieldwork, the auditor summarizes the audit findings,
conclusions, and recommendations necessary for the audit report discussion draft.
Top of Page
Audit Report
Our principal product is
the final report in which we express our opinions, present the audit findings,
and discuss recommendations for improvements. To facilitate communication and
ensure that the recommendations presented in the final report are practical,
Internal Audit discusses the rough draft with the client prior to issuing the
final report.
Discussion Draft
At the conclusion of
fieldwork, the auditor drafts the report. Audit management thoroughly reviews
the audit working papers and the discussion draft before it is presented to the
client for comment. This discussion draft is submitted to the client for review
before the exit conference.
Exit Meeting
Internal Audit meets with
the unit's management team to discuss the findings, recommendations, and text of
the discussion draft. At this meeting, the client comments on the draft and the
group works to reach an agreement on the audit findings.
Formal Draft
The auditor then prepares
a formal draft, taking into account any revisions resulting from the exit
conference and other discussions. When the changes have been reviewed by audit
management and the client, the final report is issued.
Final Report
Internal Audit
distributes the final report electronically to the unit's operating management,
the unit's reporting supervisor, the university Chief Financial Officer, the
university Chief Accountant, the university President, the Board of Trustees,
and other appropriate members of senior university management. This report is
primarily for internal university management use.
Client Comments
Finally, as part of
Internal Audit's self-evaluation program, we ask clients to comment on Internal
Audit's performance. This feedback has proven to be very beneficial to us, and
we have made changes in our procedures as a result of clients' suggestions.
Top of Page
Audit Follow-Up
Within approximately six months of the final report, Internal Audit will perform a
follow-up review to verify the resolution of the report findings.
Follow-up Review
The client response letter is reviewed and the actions taken to resolve the audit
report findings may be tested to ensure that the desired results were achieved. All
unresolved findings will be discussed in the follow-up report and reported to
the university President.
Follow-up Report
The review will conclude with a follow-up report which lists the actions taken by the
client to resolve the original report findings. Unresolved findings will also appear in
the follow-up report and will include a brief description of the finding, the original audit
recommendation, the client response, the current condition, and the continued exposure to
Indiana University. A discussion draft of each report with unresolved findings is circulated to
the client before the report is issued. The follow-up review results will be circulated to
the original report recipients and other University officials as deemed appropriate.
Top of Page
Internal Audit Annual Report to the Board of Trustees
In addition to the distribution discussed earlier, a
summary of all audits performed during the fiscal year, including follow up reports, are communicated to the Indiana University
Board of Trustees as part of the Internal Audit Annual Report.
Top of Page
The Process: A Collaborative Effort
As we have pointed out, during each stage in the audit process--preliminary review,
field work, audit reports, and follow-up--clients have the opportunity to participate.
There is no doubt that the process works best when client management and Internal Audit
have a solid working relationship based on clear and continuing communication.
Many clients extend this working relationship beyond the particular audit. Once we have
worked with you on a project, we have an understanding of the unique characteristics of
your unit's operations. As a result, we can help evaluate the feasibility of making
further changes or modifications in your operations.
Last revised April 2006
Top of Page
