Internal Audit Process

Annual Audit Plan Process

On an annual basis, OAC develops its Annual Audit Plan.  First, OAC reviews a variety of information, including senior management’s goals and objectives, applicable laws and regulations, and current industry topics and concerns, to develop an Audit Universe.  Next, interviews are held with key stakeholders across the University, which allows OAC to assess risks.  From this, the Annual Audit Plan is developed highlighting specific audits and projects that will be performed during the year.  The Plan is presented to the President and Board of Trustees for approval. The audit plan is updated periodically and may be modified as unplanned issues of potential risk are identified throughout the year from senior leadership and anonymous hotline tips.   

 

Internal Audit Process

During the course of the year, OAC works from the Plan to complete the individual projects.  While each project is unique, the core process followed by OAC is the same.  The process is outlined below and discussed during initial audit meetings with university clients:

Internal Audit Process Steps At a Glance

Risk Assessment and Scope

  • Perform research of audit area
  • Inform client of planned audit
  • Hold opening meeting with client to discuss audit scope
  • Finalize audit scope

Process Review

  • Review policies and procedures
  • Perform preliminary process walkthroughs
  • Discuss preliminary process and controls design observations
  • Plan for fieldwork/testing

Fieldwork/Testing

  • Gather data and documentation
  • Interview with appropriate individuals as needed
  • Conduct analysis and testing
  • Follow up with client regarding questions
  • Share and validate preliminary observations
  • Prepare draft report including recommendations

Reporting

  • Hold closing conference with stakeholders
  • Finalize draft report for management response and report back to university leadership
  • Incorporate management response into final report
  • Confer with appropriate university stakeholders to validate information reported
  • Draft final report to client and appropriate university leadership

Follow-Up

  • Solicit suggestions for improvements to internal audit process
  • Periodically follow up on status of management action plans
  • Confer with university leadership on status of management action plans