Internal Audit Process

Audit Team

Usually, a team of auditors headed by a lead auditor as the point of contact for an engagement performs the work. However, depending on the size, scope and complexity of the work, only one auditor may be assigned to the engagement.

Audit Engagement Letter

The Director of Internal Audit notifies responsible management with an engagement letter between 7 and 14 days before an entrance conference is held or audit fieldwork begins. The engagement letter presents: (1) the objectives of the audit; (2) the reason for the audit (Annual Risk-Based Audit Plan, Commissioners, etc.); (3) the estimated start date; (4) the location of the fieldwork; (5) any special resources needed by the audit team such as working space; (6) the name and telephone number of the primary contact from the Internal Audit Department; and (7) a statement that the contact will arrange for an entrance conference. Typically, an engagement letter may not be provided for follow-up reviews, special reviews, or audits that require the auditor's presence not to be known in advance.

Entrance Conference

This is a conference with responsible management (and provider's staff) and staff members for introduction of the audit team and to discuss: (1) the purpose, scope and principal features of the audit; (2) estimated time to complete the audit; (3) arrangements for space and access to records; (4) the management contact during the audit; and (5) any management request for audit coverage in other areas, or other concerns of management. The Director of Internal Audit or designee must be present at every entrance conference.

Preliminary Survey

This work consists of gathering background information on the operations of the entity being audited, and the related laws, rules, regulations, and policies and procedures that govern the activity. Preliminary survey procedures that need to be performed on-site may be conducted before fieldwork begins, or delayed until after fieldwork begins depending on budget constraints and the relative importance of the procedures to gaining an adequate understanding of the activity being audited.

Audit Program

An audit program is a document which lists the audit procedures to be followed during an audit. The audit program also states the objectives of the audit. Audit programs will be developed for each audit based on the results of the preliminary survey and any additional information provided before or during the entrance conference. All audit programs must be approved by internal audit management before fieldwork begins.

Fieldwork

Fieldwork is the work performed on-site to gather audit evidence to achieve the audit objectives. Audit procedures during fieldwork may include the review and test of records, interviews with management and staff, and the application of various analytical procedures. Throughout fieldwork, the lead auditor will keep management informed, and management will have opportunities to discuss observations/issues noted.

Audit Management Review

The Director of Internal Audit and/or designee, to ensure compliance with professional auditing standards, reviews the work performed by the audit team and prepare reviews notes for the auditors to clear. The review notes may request additional information and work to be performed.

Exit Conference

This is a conference with responsible management at the completion of the audit to communicate findings and recommendations developed during the audit. Also, this is an opportunity to receive management's views and seek or present clarification on the identified audit findings and recommendations.

Audit Report

Internal audit reports are first provided to responsible management as Discussion Drafts for review and response and in final Audit Report form after responses have been received. The responsible management has at least 10 business days (approximately 2 weeks) after receipt of the draft report to respond and provide action plans to the audit findings and recommendations. Responsible management's responses and action plans with anticipated implementation due dates and Internal Audit’s evaluation of management's responses are included in the final audit report. However, prior to the final issuance of the audit report, the General Manager and/or designee is given 10 business days (approximately 2 weeks) to review his/her staff’s responses to Internal Audit’s findings and recommendations to determine whether the responses are sufficient. If the General Manager and/or designee determines the responses are insufficient for any reason, then he/she can have his/her staff modify the responses accordingly. Also note, Internal Audit will not modify the audit findings and recommendations after the exit conference because they are based on facts agreed upon by management. Final audit reports are issued to the Commissioners, the General Manager, and the Team/Office responsible management.

Audit Memos

While conducting audit fieldwork, auditors will occasionally encounter findings that are directly or indirectly the result of activity or inactivity of another department(s) not currently within the scope of the audit and/or may be classified as low risk to the Commission. In these instances, a separate Audit Memo will be issued to the responsible department head to coincide with the issuance of the Audit Report. Background information about the audit and specifics about the audit finding(s) will be disclosed in the memorandum, but not the entire Audit Report. The responsible department head is expected to respond to the related audit recommendation(s) within a specified period of time and provide a plan of action (where applicable). The Audit Memo will not be distributed to the Commissioners; however, if the implementation of management’s action plan to mitigate the risk associated with the findings in the Audit Memo is more than a year delinquent, then the Director of Internal Audit will escalate the matter to the Commissioners.

Client Surveys

We are committed to a total quality approach to conducting our audits; therefore, although completely voluntary, completing our survey is one way to find out if we are meeting your expectations. At the completion of the audit, a Client Satisfaction Survey Form will be distributed to the Team Chief or Director of the team or office that underwent the audit. Completing the survey will allow us to measure the extent to which our office is meeting your its key success measure regarding our customer service.

Follow-up Reviews

It is the policy of the Internal Audit Department to conduct follow-up reviews of internal audits performed by the department. The purpose of these audits is to determine the status of actions agreed to by management in order to respond to internal audit recommendations and correct deficiencies noted in the audit. 

Last Modified: