What happens during an audit?

Internal audit conducts assurance audits through a five-phase process which includes selection, planning, conducting fieldwork, reporting results, and following up on corrective action plans.

Selection

Audit activities are selected using a risk based approach. Internal audit meets with leadership and management during the development of the annual audit plan to discusses risks and potential impediments to meeting objectives. This plan is approved by the Executive and Audit Committee of the Board of Trustees. Audits can also be conducted based on concerns reported on the fraud and ethics hotline.

Planning

Each audit requires planning, starting from defining the scope and objective to developing audit steps to meet the objective. Internal audit conducts an entrance meeting with management to discuss the purpose of the audit, risk factors, and other logistics. Management is included in the planning phase and the details are documented in a planning and scoping memo.

Fieldwork

During the fieldwork phase, auditors conduct the steps identified in the planning process. Steps often include conducting interviews, reviewing laws, policies and best practice, verifying sample transactions, analyzing data sets, and conducting surveys. Auditors meet regularly with management throughout fieldwork and discuss the status of the audit, preliminary observations, and potential recommendations.

Reporting

Auditors conduct an exit meeting with management at the conclusion of the fieldwork to discuss the results of the audit, specific findings and recommendations and other observations. Auditors communicate these to management through an audit observation memo and ask management to provide a response with a corrective action plan and timeline to implement. These responses are included in the final report. Management and leadership are provided an opportunity to review drafts and provide feedback.

Follow-up

All audit recommendations and management corrective action plans are followed up on to provide assurance that plans are implemented. Corrective action plans that do not appear to be progressing are reported annually to the president and Executive and Audit Committee.