There are generally four stages for the Internal Audit process: planning, fieldwork, the audit report, and follow-up review.
1 - PLANNING PHASE
During the planning phase of an audit, along with management being notified, information is gathered about the area to be reviewed, and existing controls are evaluated.
Entrance Conference
Prior to beginning an audit, management is informed of the audit indicating the scope and objectives of the review. During the entrance conference, the internal auditor meets with the management directly responsible for the unit under review and any staff members management may wish to include. Management describes the unit or system to be reviewed, the organization, personnel, facilities, equipment, funding sources, and other relevant information. It is important that management identify issues or areas of special concern that should be addressed as part of the audit.
Internal Control Analysis
The internal control structure will be reviewed to determine the areas of highest risk and to design tests to be performed in the fieldwork section.
2 - FIELDWORK PHASE The fieldwork concentrates on transaction testing and informal communications. It is during this phase that the auditor determines whether the controls identified during the preliminary review are operating properly and in the manner described by management and departmental personnel. The fieldwork phase concludes with a list of significant observations from which the auditor will prepare a draft audit report.
Testing
After completing the preliminary review, the auditor performs testing of the major internal controls and the accuracy and propriety of the transactions.
Communication
As the fieldwork progresses, verbal and/or written communications are made on any significant observations and are discussed with management. Hopefully, management can offer insights and help regarding the best method of resolving the observation. The goal is for there not to be any surprises.
3 - AUDIT REPORT PHASE
The final report is the principal product where audit observations and recommendations for improvements are presented.
Draft Report
At the conclusion of fieldwork, a draft report is generated. The draft report is submitted for management's review, before the exit conference and prior to issuing the final report. This process facilitates communication and ensures that the recommendations presented in the final report are factual and practical.
Management's Responses
Management has the opportunity to respond to the audit observations and recommendations prior to issuance of the final report. These responses will be included or attached to the final report. In the response, management must explain how the observations will be resolved and include an implementation timetable. In some cases, managers may choose to respond with a decision not to implement an audit recommendation and to accept the risks associated as stated in the audit observations. Management should provide an explanation regarding non-acceptance of the audit observation and/or recommendations.
Exit Conference
A meeting is held with management to discuss the draft audit report and management's comments. The draft report is revised for any agreed upon changes from the exit conference and other discussions. Then the final report is issued to the report recipients and other University officials as deemed appropriate.
4 - FOLLOW-UP REVIEW PHASE
Approximately one year later, someone from Internal Audit will request a status report from management to determine the action(s) taken for the audit recommendations. Management's responses are reviewed and the actions taken to resolve the audit observations may be tested to ensure that the desired results were achieved. All unresolved observations will be discussed in the follow-up report. Unresolved observations will also appear in the follow-up report, including a current status of the original observation and recommendation. A discussion draft of each report with unresolved observations is circulated to management before the report is issued. Then the follow-up report will be circulated to the respective University personnel and officials.
The Internal Audit Process:
A Collaborative Effort
During each stage in the audit process, departmental personnel have the opportunity to participate, which is strongly encouraged. The audit process works best when management and Internal Audit have a solid working relationship, based on clear and continuing communication.
In many cases, this working relationship is extended beyond the particular audit. Once Internal Audit has worked with management on a project, an understanding of the unique characteristics of the department's/unit's operations obtained. As a result, Internal Audit can help evaluate the feasibility of making further changes or modifications for the operations of that department.
For any additional information, please contact:
Ralph B. Kimbrough, Jr
Internal Auditor
Kentucky State University
301 ASB
400 E. Main Street
Frankfort, KY 40601
Phone: 502-597-5117
Fax:502-597-6953