Office of Internal Audit

 

Audit Process

An internal audit of your unit or function is about to begin. This document will acquaint you with the internal audit process at ISU.

The Office of Internal Audit is part of the ISU President’s Office; therefore members of the Internal Audit staff are ISU employees. Internal audits are conducted by an internal auditor and supervised by the internal audit manager, who reports to the director of Internal Audit.

Audits are conducted in four phases as described below. Note the underlined items: Although we try to avoid jargon, we are likely to use some terms that may be unfamiliar outside of our profession.

1. Planning Phase

The planning phase begins with the initial meeting or “entrance conference” in which Internal Audit staff talks with you about the audit process, the tentative scope of the impending audit, your operations, and any questions or suggestions you may have for the audit.

During the remainder of the planning phase, the auditor will use various resources to learn more about your operations, including interviewing staff members and reviewing --

• Strategic, procedural, and other documentation provided by your unit

• Laws and regulations to which your unit must adhere

• Your unit’s financial activities and transactions

• The internal control environment of your unit

At the conclusion of the planning phase, the auditor will perform an audit risk assessment based upon the information gathered. This risk assessment will help the auditor to write an “audit program” that is specifically tailored to your unit’s unique operations and risks. An audit program is simply a detailed list of test steps that the auditor will perform during the fieldwork phase in order to evaluate your unit’s processes and internal controls.

2. Fieldwork Phase

During the audit fieldwork phase the auditor carries out the test steps outlined in the audit program. The auditor will select and examine samples of transactions, observe processes, and conduct additional interviews, as needed. To avoid any surprises at the end of the audit, the auditor will let you know throughout the audit as he or she identifies concerns or areas for improvement, called “observations.”

3. Reporting Phase

Reporting involves summarizing all the auditor’s observations, and meeting with you to discuss at one time all the observations you have been notified about throughout the audit. At the “observations meeting,” we will come to a common understanding of the concerns noted and the auditor will provide his or her suggestions for how to make improvements. The audit staff and your staff will collaborate to develop an action plan for improvement that is both effective and feasible.

After the observations meeting, the auditor will write a draft of the audit report, concisely describing each condition and the tentative plan of action for rectifying the conditions. The auditor will then schedule another meeting (called an “exit conference”) with you to review the draft audit report in detail, ensuring the conditions are presented factually, and the action plans accurately reflect your intentions. Together you and auditor will establish feasible target dates by which each action plan will be implemented.

After finalizing the draft audit report, the auditor will provide it to you once again for review before the report is issued. Once we are in agreement about the presentation of the report, the auditor will issue the final audit report to you, the president and his assistant, vice presidents and provost, associate controller, the Board of Regents, State of Iowa and the Auditor of State.

4. Follow-up Phase

Internal Audit follow-up reviews consist of requesting from applicable management a report on the status of action plans. We will provide a report form to facilitate management's response and will ask that the form be signed by relevant University officials to indicate approval of the action taken. Upon receiving the completed and signed management's report, the document will be provided in its entirety to appropriate University officials and the Board of Regents Office.

Questions? At any time during the audit, please feel free to ask questions about the audit process. We don’t want the audit to be mysterious--rather, it is an opportunity to focus on your operations and identify opportunities for improvement.