HUMBLE

Every audit project is unique. However, there are similarities in the process auditors use. In most audits, the process consists of four stages: Planning, Field Work, Audit Report, and Follow-Up. 

Planning
To illustrate the audit planning process, we will use the operational audit, the one we perform most frequently. In an operational audit, the auditors are evaluating whether the client's resources are appropriate for its mission and objectives, and whether those resources are being used efficiently and effectively. During the planning process, we seek to determine:

• the goals of the unit or system being reviewed

• the objective of the audit, and

• the approach the auditor will used to meet these objectives.

The planning stage begins with an entrance conference and a preliminary survey, which lead to a planning memorandum.

Entrance Conference
Before any work begins, the client describes to the auditor the unit or system to be reviewed, the organization, and the available resources, including personnel, facilities, equipment, funds, and other relevant information. The internal auditor meets with:

• management from all interested office and units; and

• the senior officer (Dean, Chairman, Director, Vice President) responsible for the unit under review.

It is important that the client identify, at this initial meeting, issues that should be addressed or areas of special concern.

Preliminary Survey
In the survey phase, the auditor gathers relevant information about the unit in order to obtain an overview of it. He talks with people involved in the unit and reviews reports, files, and other sources of information. During this phase, a work plan is developed. As in any special project, an audit results in a certain amount of time being diverted from your unit's usual activities. One of our key objectives is to minimize this time and to avoid disruption in your ongoing activities. We try to avoid interfering with your busy periods and need your assistance in setting up a work plan to do so.

Planning Memorandum
This document, usually short, presents the auditor's understanding of the objectives of the project and outlines what the audit team will do to meet the objectives. Included are data about the goals of the unit, and the size and scope of the unit or system, as well as related information, such as an organization chart.

Field Work
Field work begins with systems analysis, followed by transaction testing, and includes continuing advice and informal communications. The field work stage ends with the exit conference, an important meeting for both the client and the auditor to discuss potential audit findings or areas in need of improvement.

Systems Analysis
An operational auditor works primarily in systems analysis. The auditor reviews the system's documentation and capabilities, a process which may be very time-consuming. In many audits, systems analysis takes fifty percent or more of the field work time. In systems analysis, the auditor uses a variety of tools and techniques, including flow charts, interviews, data gathering and analysis, and techniques for documenting findings.

Transaction Testing
After completing the systems analysis, the auditor tests the important controls. Only the critical aspects (for example, authorization or documentation) are tested. The purpose of testing is to determine if:

• the control is reliable; and

• transactions comply with rules and regulations.

Advice and Informal Communications
As field work progresses, the auditor discusses any significant findings with the client. Usually, these communications are oral. However, in more complex situations, memos are written in order to ensure full understanding by the client and avoid mistakes by the auditor.

In particular cases, we may also provide drafts of organization charts, proposed forms or modifications to forms, financial data or other statistics, or drafts of findings and recommendations that later may be incorporated into the formal audit report. These are all considered informal communications between the auditor and the client. Their purpose is to promote constructive communication and avoid misunderstandings. Our goal: No surprises.

 Exit Conference
At the conclusion of field work, we meet with your unit's management team to discuss proposed findings and recommendations. For larger, complex projects, this exit conference may be held in two stages; the first meeting provides time for extended discussion of findings, and recommendations are the focus of the second meeting. 

For most audits, the exit conference is held after the development of an informal discussion draft of the audit report. In these cases, the exit conference may be used to discuss the text of the draft in addition to the findings and recommendations.

AUDIT REPORTS
A principal product of an audit project is the final report in which recommendations for improvement are made and the client's plans for implementation are described. To facilitate communication and ensure that recommendations presented in the final report are practical, Internal Audit prepared two drafts of the report: the informal discussion draft and the formal draft.

Informal Discussion Draft
At the conclusion of field work, the auditor prepares a report outline. After Internal Audit management reviews the outline, the auditor uses the outline to write a first draft of the report. Internal Audit management reviews the draft thoroughly before it is presented to the client.

This informal discussion draft is prepared only for the unit's operating management and is the focus of the exit conference. At this meeting, the client comments on the informal draft, and any inaccuracies or impractical recommendations noted by the client are resolved to the extent possible. 

Formal Draft
After the exit conference, the auditor prepares a formal draft, taking into account any revisions resulting from the exit conference and other discussions. Accompanying the draft is a memorandum requesting the client's written comments within forty-five days. 

If appropriate, the formal draft may be shown to the next level of management at this point. We do not recommend circulating this document more widely because it is still a draft and has not been the subject of a written response by management. 

Final Report
After the client responds to the formal draft (within forty-five days), a final report is issued by Internal Audit. It includes: 

• the formal draft,

• client management's written comments, if any, regarding the findings and management's plans for implementing the recommendations or otherwise dealing with a particular recommendation, and

• any additional comments considered necessary by the Director of Internal Audit.

This package is assembled, copied, and bound into covers by the Office of Internal Audit, which then distributes, copies, confidentially, to all interested parties, including appropriate members of senior University management.

AUDIT FOLLOW-UP
In many cases, forty-five days will not be sufficient time for management to implement the recommendations made. In this situation, the client should explain, in the written comments made on the formal draft, when implementation will be accomplished, preferably with a timetable of particular milestones. Internal Audit will follow up with client management to ascertain that the recommended improvements are made. Our clients report that these improvements represent one of the most significant benefits they obtain in working with Internal Audit.  

In addition, as part of the Office's self-evaluation program, we ask clients to "audit the auditors," that is to comment on Internal Audit's performance during a project. This feedback has proven to be very beneficial to us, and we have made changes in our procedures as a result of clients' suggestions.

 THE AUDIT PROCESS: A COLLABORATIVE EFFORT
As we have pointed out, during each stage in the audit process--Planning, Field Work, Audit Report, and Follow-Up--clients have the opportunity to participate. There is no doubt that the process works best when your unit's management and Internal Audit have a solid working relationship based on clear and continuing communication. 

Many clients extend this working relationship beyond the particular audit. Once we have worked with you on a project, we have an understanding of the unique characteristics of your unit's operations. As a result, we can advise you as you evaluate the feasibility of making further changes or modifications in your operations.