Department of Internal Audit

Planning

Your department or business process audit begins with an audit memo notifying you that we would like to begin the initial discovery phase of the audit-kicking off with an opening conference.

• Who attends the opening conference? Internal Audit team members will work with department heads to determine those who should attend the opening conference. Attendees typically include line managers and those from whom auditors may request documentation and other information.
• Why have an opening conference? The main goal of the meeting is to introduce Internal Audit team members to your team, to provide an overview of the audit process, and to answer any questions you or your team may have.
• Is the opening conference in-person or virtual? Conferences are typically held virtually. If you and your team prefer in-person, Internal Audit would love to come to your location.
• How long is the opening conference? Approximately 30 minutes.

After the opening conference, auditors will interview staff and review documentation to narrow the focus or scope of the audit. A follow-up meeting to review the scope may be scheduled.

Fieldwork

This is the heart of the audit and where the auditors spend the bulk of their time performing tests.

• What types of tests are performed? Auditors review PeopleSoft and other computer-generated information and compare that to original documentation. A main focus of audit fieldwork is testing for controls, or checks and balances, over the flow of information.
• How long does fieldwork last? Depending on the scope of the audit, fieldwork may last 2-3 months.
• How can I make fieldwork go more quickly? The easiest way to get through an audit as quickly as possible is to respond to internal auditors’ requests and questions timely.

Reporting

Once fieldwork is completed and audit results are compiled and reviewed, it is time for the auditor to report on the audit.

• What gets reported? Audit reports typically focus on areas of improvement. When a department or business process is performing exceptionally well, these “successes” may also be reported.
• What is the typical process for finalizing the report? Internal auditors will draft a report identifying why the audit was performed (objectives), what they looked at (scope), and what they found (results). Once the report is drafted, they will hold a closing conference to discuss the draft report, answer any questions you may have, and resolve any disagreements as to issues identified.
• Do I get to say anything in my defense? Yes! Every audit report includes management’s responses to proposed recommendations. You are typically given 2 weeks after a closing conference to submit your responses. Instructions and guidance are provided along the way.
• What happens with the report? Internal auditors will distribute the official report to the Board of Trustees Audit Committee, the President, and appropriate personnel—including the respective Senior Vice President.

Follow-up

If your audit report included recommendations, internal auditors will return to review your progress in implementing improvements. The timing of the follow-up depends on when improvements have been made. Internal auditors use the completion dates included in the audit report to plan a return visit. They will check with you before coming. A progress report will be issued after the follow- up has been performed.