Entrance Letter

• When beginning an audit, the Director will send an entrance letter to management of the department being audited notifying the department of the objectives of the audit.

Entrance Conference

• The Director and the Auditor-in-charge will meet with management to discuss the nature and scope of the audit, and any concerns management might have. Management should bring to the conference any personnel deemed appropriate.

Preliminary Review

• The Auditor will review the internal control structure, perform a financial analysis, and/or determine the areas that need further review and testing.

Fieldwork

• The Auditor will gather sufficient evidence through observation, testing, inspection, etc., to provide a reasonable assurance of the audit conclusions. During this process, the Auditor-in-charge will keep management informed on the progress of the audit.

Audit Results Meeting

• The Auditor-in-charge and the Audit Director will meet with management to discuss the audit results. The draft report is provided either during the meeting or shortly thereafter for management's review.

Draft Audit Report and Management's Responses

• The department being audited receives a copy of the draft report to review for accuracy. In addition, management provides a corrective plan of action for each audit finding to Internal Audit by the requested response date. Corrective action plans must completely mitigate the control issue described by the audit findings, identify a responsible party for the corrective action, and contain an estimated target date by which the corrective action plan will be implemented.

Final Report

• The report is finalized to include the audit findings, recommendations, department's responses and auditor's conclusion, and sent to the President of the Board of Trustees for approval.
• Once approved, the final report is distributed to the appropriate members of management and the Board of Trustees.

Follow-up Audit

• Internal Audit performs a follow-up audit to review and report on the extent of implementation of recommended corrective actions from the previous audit.

Length of an Audit

• Audits may vary in length. An internal control review may take two to three weeks, while other broad based audits may take six to eight weeks.