Every successful audit is based on sound planning and an atmosphere of constructive involvement and communication between the client and the Internal Auditor. Our objective is to involve client management throughout each stage of the audit. Management’s participation results in both a better understanding of unit operations and a more effective implementation of recommendations. The majority of internal audits performed at West Virginia University go through four major phases: Planning, Field Work, Report Writing, and Follow-up. These phases are discussed in the following paragraphs:
In the planning phase the Internal Auditor establishes clear-cut audit objectives to avoid aimless investigations into insignificant areas. In addition, the Internal Auditor prepares estimates of the resources necessary to achieve the objectives and determines the audit techniques to be used. West Virginia University Internal Audit utilizes three steps to complete this phase of the audit project: Entrance Conference, Preliminary Survey, and an Audit Planning Memorandum.
Entrance Conference – Representatives of the WVU Internal Audit Office meet with client management before the audit field work begins to discuss the audit objectives, approximate duration of the audit, work space requirements for the audit team, and the audit report process. Client management is asked to designate a primary contact person from their staff to assist the audit team and to answer questions that might arise. Client management is also encouraged to use this opportunity to identify special concerns that should be included in the audit planning and to inform the auditors about any special time constraints that must be observed during the audit. It is the goal of the WVU Internal Audit Office to minimize the amount of disruption to ongoing departmental activities as a result of the audit process. However, some disruption will occur and it is best to plan for it during this phase of the audit. Representatives from client management attending this meeting usually include the Dean or Director, Chairperson or Department Heads, and Business Managers.
Preliminary Survey – This is a general information- gathering process used by the Internal Auditor to obtain an overview of the client’s operations, practices, and policies. The information gathered in this step is generally from discussions with departmental personnel, and reviews of reports and files maintained in the department. The survey process can take from several days to several weeks depending on the audit objectives, availability of records, and the Internal Auditor’s prior understanding of the department’s operations. The Internal Auditor uses this information to refine the audit objectives and the audit procedures required to accomplish them. This step is very important because it determines the direction that the audit field work will take.
Planning Memorandum – The planning memorandum presents the Internal Auditor’s understanding of the function(s) to be audited, the objectives of the project, the audit procedures to be used to accomplish the objectives, a budget of resources needed, any special aspects to be considered, the period to be audited, and departmental audit contacts. This document is shared with the client and serves as a formal understanding between the client and the WVU Internal Audit Office as to the scope and objectives of the examination. In some special purpose audits this phase of the audit process is excluded.
Audit field work can be classified into four categories: system analysis and evaluation, transaction testing, informal progress reporting, and discussion of audit conclusions and recommendations at the exit conference.
System Analysis and Evaluation – Much of the audit work performed is based on management’s system of internal control. The audit team begins their evaluation of internal control by reviewing system documentation and capabilities. Particular emphasis is placed on the assignment of duties, the approval process, and the reporting structure. This information is obtained primarily through interviews and flow charts. The audit team’s opinion regarding the adequacy of internal control has a direct relationship to the amount and depth of the second category of audit field work, transaction testing.
Transaction Testing – To determine if the reported controls are functioning as intended, the audit team selects samples of documents and inspects them for compliance with stated procedures and practices. The results of these tests provide the audit team with a degree of assurance regarding the reliability and adequacy of the controls, and a means of measuring operational effectiveness and accountability. Through these analyses, the audit team is able to determine if client management is achieving the stated mission for their unit. The audit team documents the test samples and results, both positive and negative, in audit work papers. Historically, audit work papers consisted of large quantities of paper files stored in notebooks. The WVU Internal Audit Office has committed itself to the use of personal computers for work paper analysis and the storage of files to the greatest extent possible. The use of computers “in the field” has given the Internal Auditor the ability to perform complex analysis quickly and with far less effort. Thus, the modern-day Internal Auditor is much more efficient than ever before.
Progress Reporting – The audit team leader meets with the designated management representative during the course of the audit field work to discuss audit progress, audit test results, and conclusions and recommendation. The purpose of these meetings is threefold: to clarify any misunderstandings, enlist management’s opinion and support in solving any problems discovered, and to ensure timely implementation of recommendations. Our goal is to discuss with management all significant weaknesses discovered during the course of the audit field work, and to achieve an agreement regarding corrective action to be taken by management prior to the release of the final audit report. In short: a cooperative effort with no surprises.
The exit conference is a meeting between the audit team and client management with the purpose of discussing audit tests, results, conclusions and the resulting recommendations. This meeting often occurs after a discussion draft of the audit report has been prepared. The advantage of holding the exit conference after the draft has been prepared is that management has an opportunity to comment on the specific language that will appear in the final audit report. Thus, issues and descriptions of operating practices and policies that may appear to be clear to the writer can be discussed and further clarified prior to the audit report distribution. Audit Report The WVU Internal Audit Office utilizes a three-phase approach to audit report preparation: informal rough draft, discussion draft, and formal report.
Informal Rough Draft – After the audit field work is completed, the Internal Auditor prepares a rough draft of the audit report. The report states the audit objective(s), the audit tests performed, the results of the audit tests, and a recommendation for improvement.
The rough draft of the audit report is circulated and discussed internally within the WVU Internal Audit Office prior to its release to the client.
Discussion Draft – After undergoing internal review, the report is forwarded to the client with the notation that it is a tentative report for discussion purpose only. Generally, client management is requested to review the draft and contact the WVU Internal Audit Office to discuss the contents within a fifteen-day period. We strongly urge the client not to distribute the report to anyone other than operating management because the report is still in the draft stage and is subject to change. The discussion draft of the report is reviewed in detail during the exit conference (see prior discussion of audit field work categories) between client management and the WVU Internal Audit Office representatives. At this meeting, we strive to reach an agreement on our conclusions and the approach to be taken by management to implement recommendations.
Final Report – The final report is prepared based on the results of the exit conference. The client’s response to each recommendation is also incorporated into the final report if it is available within a reasonable time period following the discussion draft meeting. Confidential copies of the final report are distributed to the Dean/Director of the area audited, the appropriate Vice-President(s), and the President’s Office. A cover letter attached to the report requests a formal written response, usually within thirty days, from the audit client if it was not already incorporated into the final report.
After a reasonable period of time, we contact the audit client to request a status report on the corrective action taken to date. We evaluate the effectiveness of the corrective action taken and advise the client on alternatives that they can employ to achieve the desired improvements. In larger, more complex audit situations this step may be repeated several times as additional changes are initiated. Additional on-site visits and reviews may be performed to ensure adequate implementation of recommendations.