Guide to the audit process
Helpful information regarding the reasons for auditing, types of audits and their scope, and details on the audit process.
Topics on this page:
The audit process typically involves several key steps to evaluate an organization’s financial, operational, or compliance performance. These steps include:
- Planning – where the audit scope, objectives, and criteria are defined
- Data collection – involving the review of documents, records, and systems
- Testing and analysis – to assess controls, processes, and compliance
- Reporting – where findings and recommendations are documented and
- Follow-up – to ensure compliance and ensure corrective actions are implemented.
The process aims to identify risks, ensure compliance, and improve organizational efficiency.
Why audit?
Internal controls and regular audits validate that processes and procedures utilize best practices, are effective, and compliant. These help ensure good stewardship of University assets, reliable and secure financial and data management, efficient resource deployment, and regular business process improvement.
Types of audits
The audit process
A collaborative approach
A successful audit is built on constructive and cooperative engagement between the auditor and the audited department. The audit process actively involves management at every stage, as effective communication is essential to its success. This collaborative approach helps to mitigate the negative perceptions often associated with the term “audit”. The goal of the Office of University Audit is to be a partner, not an adversary, to the departments it audits, with open and effective communication serving as a cornerstone of this partnership.
Duration
The duration of an audit can vary significantly, ranging from a few hours to several weeks, depending on its scope and objectives. Efforts are made to ensure that departmental activities experience minimal disruption during this time. Additionally, much of the audit work is conducted outside the department, meaning direct interaction with departmental employees is not required throughout the entire process.
- Scheduling
Scheduling an internal audit is a collaborative process designed to ensure transparency, efficiency, and alignment between the audit team and the client. The process involves defining the audit’s scope and objectives, notifying the client, and coordinating logistics to ensure a smooth, effective review. Open communication and mutual understanding are key to establishing a clear timeline, addressing any concerns, and preparing for the audit activities. By following a structured approach, the Office of University Audit ensures the client is fully informed and ready to participate in the audit.
2. Planning
During the planning phase of an audit, the objectives are clearly defined, and the audit techniques are determined. A preliminary meeting is scheduled with the department or area to be audited. During the meeting, the audit team and department personnel discuss the purpose and objectives of the audit, as well as any specific concerns the department wishes to address as part of the process.
As part of planning, the audit team conducts a risk assessment, performs an analytical review of its ledger accounts, and designs audit techniques to achieve the defined objectives. An audit program is then developed, serving as a detailed plan of action to guide the audit process.
3. Field Work
The auditor proceeds to the measurement and evaluation phase of the audit, commonly referred to as fieldwork. During this phase, the auditor gathers and assesses information, including evaluating the strengths and weaknesses of internal controls and determining adherence with University policies and applicable government regulations. Testing of departmental records is conducted as necessary to enable the auditor to form an opinion and provide recommendations for improvement.
Upon completion of the fieldwork, an exit meeting is held with relevant management to review the audit findings, observations, and recommendations. Additionally, progress meetings are informally conducted throughout the audit process to keep administrators informed of any significant findings as they arise.
4. Audit Report
The final result of each audit is a comprehensive written report provided to senior management. This report outlines the audit background, scope, conclusions, significant audit findings, and recommendations for improvement.
We request that management provide a written response to all findings that include recommended actions. Management’s detailed plans for addressing audit findings are incorporated into the final audit report, which is then distributed to senior management.
Additionally, the Chief Audit Executive prepares an annual report summarizing all completed audits. This report includes significant findings, audit conclusions, and management responses. The Chief Audit Executive meets with the Audit Committee of the Board of Trustees four times per year to review the Office of University Audit’s activities, discuss significant findings, and provide updates on audit outcomes.
5. Follow-Up
Within a reasonable time after completion of an audit, a follow up review is completed. The primary objectives of this review are to determine whether recommended procedures have been implemented and to evaluate whether the intended results are being achieved.
Related offices and departments
Other resources
Fraud in the workplace: prevention and detection
Common examples of fraud, typical contributing factors, best practices to avoid fraud, and how to detect and report fraud when necessary
How-to
Guide to internal controls and risk
Audit term definitions, a description of roles and responsibilities, goals of best practice internal controls, common weaknesses in financial processes and how to avoid them, and answers to your internal control questions.
Policy or guideline
Recommended internal controls for financial management
Definitions of terms and an introduction to internal control procedures including analysis, review, and reconciliation measures necessary to mitigate risk in financial management for each Financial Activity Object (FAO).
How-to