Internal Audit Process

Each internal audit begins by defining the specific scope and objectives. The scope establishes the project boundaries, setting what the audit will and will not include. The objectives state what the audit will accomplish. Once these are determined, the audit continues through three phases.

Planning - Auditors ask questions, examine documents and make observations of the process being audited. This helps auditors gain an understanding of how the work is currently being done. Auditors write an audit program defining the steps that will be taken to evaluate the effectiveness of the process being audited. Auditors and managers in the audited area discuss the audit program to allow managers the opportunity to make suggestions about what is to be evaluated during the audit.

Fieldwork - The audit team completes the work detailed in the audit program. The work focuses on what could go wrong in the audited process and whether there are procedures to prevent breakdowns. If no preventative measures are in place, auditors develop recommendations with the help of department personnel. If procedures are in place, auditors test them to make sure they are functioning properly.

Reporting - As the audit progresses, auditors write Corrective Action Plans (CAP) that report the results of fieldwork and include recommendations for correcting problems auditors observe. These are first issued in draft form and discussed with department managers to allow them to have input. After a final CAP is agreed upon, department managers provide a written response describing what action they will take. At the end of the audit, a report summarizing the audit results is written.

Following up - Internal Auditing follows up with managers to monitor the progress of corrective action. Each year, inquiry forms are sent on every pending item. Managers provide information on whether corrective action has been completed, is progressing, or will not be completed due to changed conditions. The responses to the inquiry forms are summarized and reported in the annual Report of Management Actions.