Risk Based Audit Plan

The internal audit process begins with the Risk Based Audit Plan, which is updated every six months and approved by the Board of Regents. Once approved, the Plan becomes a guideline for conducting audits and consulting services in the coming 18 months. In addition to the audits and consulting services performed under the Plan, the Office of Internal Audit also conducts advisory and other services on demand.

Engagement Letter

The Office of Internal Audit notifies the unit to be audited in writing when his or her area is selected for an audit. This document, which is referred to as an engagement letter, indicates general objectives of the audit, the projected time frame of the audit and preliminary information the client will need to supply.

Entrance Conference

An entrance conference is scheduled with the unit head to discuss the purpose, scope, and process of the audit. The Internal Auditor attends the entrance conference with personnel deemed appropriate by the unit head. Attendees are encouraged to present any questions or concerns they have about the audit. Unit heads may request that a specific function or area of their office be examined during the review or in future work.

Preliminary Survey

During this portion of the audit, the Internal Auditor will gain an understanding of the unit's business, procedures, objectives, size, etc. Written policies and procedures, organizational charts, related forms and job descriptions enable the auditor to plan the audit tests to be performed and to become familiar with the unit's operations. Internal controls are reviewed and documented during this portion of the audit.

Fieldwork

This phase of the audit includes testing the internal controls and performing other audit procedures necessary to accomplish the objectives of the audit. The unit head is notified of any potential audit observations and recommendations through status meetings.

Exit Conference

An exit conference is scheduled for the last day of fieldwork. The Internal Auditor presents a summary of observations and gathers cause statements from management. The exit conference also provides an opportunity to discuss the audit observations and clarify any ambiguities.

Draft Audit Report

Internal Audit's goal is to complete the audit and issue a draft audit report within 30 days after the completion of fieldwork. The draft audit report is prepared from the summary of observations presented at the exit conference. A written response to the draft report is required within 3 weeks of receiving the draft report. Management's responses must include the unit's plan for corrective action, the name and title of the person responsible for implementing the corrective action and the date by which the action will be implemented.

Final Report

The final report is issued to the unit head, appropriate supervisors, the University President, and the Chief Audit Officer and Associate Vice Chancellor at the Board of Regents.

Follow-Up Review

The unit head is expected to notify the Internal Auditor within 90 days of implementing audit recommendations or other adequate controls, as justified. The Internal Auditor will review implemented corrective actions and clear audit observations. The Internal Auditor will submit a quarterly status report with new and open observations to the University President and Associate Vice Chancellor for Internal Audits.