"On a personal level, everyone must answer the following question. What is my highest aspiration? The answer might be wealth, fame, knowledge, popularity, or integrity. But if integrity is secondary to any of the alternatives, it will be sacrificed in situations which a choice must be made."
Dr. L. Murphy Smith
Texas A&M University
Audit Process
1. Risk Assessment
Risk assessment is an on-going process where internal audit and management seek to identify and evaluate areas that may have significant risk exposure. Risk factors may be related to financial, legal, health and safety, environmental, reputational, sensitivity of data, results of previous audits, etc.
2. Annual Audit Plan
Areas identified through the risk assessment process will be added to the annual audit plan. The Internal Audit Director will coordinate the audit plan with the President's Council and the Church Educational System (CES) Audit Committee to ensure appropriate resources are available to conduct audits and minimize duplication of effort.
3. Audit Notification/Opening Conference
The Internal Audit Director will notify the area to be audited at the commencement of the audit and schedule an opening conference. The only exception to this practice will be for audits where notification might compromise audit findings, such as fraud investigations.
4. Planning/Opening Conference
Planning involves developing the audit objectives and defining the audit scope, ensuring appropriate resources are available to conduct the engagement, and developing the audit program. An important part of planning is the opening conference. The purpose of the opening conference is to introduce the audit team, explain the audit process, describe the nature and scope of the audit, identify the timetable for completion of the audit, discuss logistics for access to records and personnel, and discuss any issues that may have a significant impact on the audit.
5. Fieldwork
Fieldwork is the process by which the audit team identifies sufficient, reliable, and relevant information to accomplish the engagement scope and objectives. Conclusions reached by the audit team are based upon and supported by appropriate analysis and evaluations of information gathered during planning and fieldwork.
6. Draft Findings
During fieldwork, the audit team will prepare draft findings which are the comments and recommendations to be made to the audit area. Each audit finding identifies the criteria upon which the finding is based, the condition or situation observed or tested, the cause and effect of the situation, and the auditor's recommendation.
7. End of Fieldwork/Closing Conference
Once the fieldwork is complete and a draft findings are prepared, the audit team will meet with key personnel to discuss the draft findings, ask for any clarification of audit issues, review draft findings for factual or grammatical errors, explain the process for and timeline for management's response to the audit findings, and request management's response.
8. Management Response
Management will be given an opportunity to provide a response to the audit findings. Management's response should include whether or not they agree with the finding, a specific plan of action to correct the weakness, identify the person responsible for implementing the plan of action, and a timeline in which the plan of action will be implemented.
9. Reporting
Following the inclusion of management's response and review of the draft findings, the audit team will prepare a draft report to which includes management's responses. This draft report will be given to management for review. When all parties agree to the content of the report, the Internal Auditor Director will issue the report to appropriate levels of management within the audit area, the Vice President over the audit area, and the President of the University. A copy of the report will also goes to the CES Director of Auditing, the Church Auditing Department and the CES Audit Committee.
10. Audit Wrap-Up
The audit team ensures that appropriate and adequate documentation exists within the audit workpapers. In addition, any documentation that has on-going relevance will be added to the permanent audit files.
11. Follow-Up on Action Items
As the time for completion of action items expires, Internal Audit Department requests appropriate follow-up information regarding actions taken by management. Where appropriate, Internal Audit Department performs tests that support completion of action items. If the Internal Auditor Director is not satisfied that appropriate corrective action has taken place, the Internal Auditor Department will continue to follow-up with the appropriate level of management to ensure that action is taken. If the Internal Auditor Director is satisfied that appropriate corrective action has taken place, the matter is closed.
