The audit is announced through an engagement letter. Internal Audit notifies the auditee in writing when his or her area is selected for an audit. This document, which is referred to as an engagement letter, indicates general objectives of the audit, the projected time frame of the audit, and information to be provided by the auditee.
An entrance conference is scheduled. An entrance conference is scheduled with the auditee representative to discuss the purpose, scope, details of documentation required, and process of the audit. Attendees are encouraged to present any questions or concerns they have about the audit. Unit heads may request that a specific function or area of their office be examined during the engagement or a future engagement.
A preliminary evaluation is performed. During this portion of the audit, the internal auditor will gain an understanding of the unit's business, procedures, objectives, size, etc. Written policies and procedures, organizational charts, related forms and job descriptions enable the auditor to plan the audit tests to be performed and to become familiar with the unit's operations. Internal controls are reviewed and documented.
Fieldwork is conducted. This phase of the audit includes testing the internal controls and performing other audit procedures necessary to accomplish the objectives of the audit. The unit head is notified of any audit observations and recommendations through status meetings.
Exit Conference is held. An exit conference is scheduled for the last day of fieldwork. The internal auditor presents a summary of observations and gathers cause statements from management. Further, it is an opportunity to discuss the audit observations and clarify any ambiguities.
A draft audit report is completed. Internal Audit's goal is to complete the audit and issue a draft audit report within 30 days after the completion of fieldwork. The draft audit report is prepared from the summary of observations presented at the exit conference. A written response to the draft report is required within 2 weeks of receiving the draft report. Management's responses must include the unit's plan for corrective action, the name and title of the person responsible for implementing the corrective action and the date by which the action will be implemented.
The final report is issued. The final report is issued to the unit head, appropriate supervisors, the University President, and the Chief Audit Officer and Associate Vice Chancellor at the Board of Regents.
A follow-up review is conducted. The unit head is expected to notify the Office of Internal Audit within 90 days of receiving the audit report as to whether or not audit recommendations have been implemented. The Internal Auditor will submit a quarterly status report with new and open observations to the University President and Associate Vice Chancellor for Internal Audits.