What to Expect During an Internal Audit
Every internal audit is unique, but each follows a general framework of professional and regulatory standards. The internal audit department should typically provide information about the purpose and timing of its audit work at the onset of the planning stage. Audits can also vary in the amount of time they will take; they may last anywhere from a day to up to nine months or more. Occasionally, there may be reason that an auditor may not be able to disclose certain information about audit work due to a variety of reasons. Some audits may even be unannounced or not disclosed at all. Nonetheless, all auditors should be professional and be able to provide appropriate answers to questions and concerns. Here are some helpful points:
- Help the auditors help you – it will make their work go faster and ultimately minimizes your time in the end.
- Own the process along with the auditors so you can get the greatest benefit.
- It’s okay to disagree; communication is most important and can bridge anything.
- Keep in mind that auditors are constantly learning about different processes and functions and they do not likely hold the same level of expertise as you do about your function; your help is essential and speeds up their work.
- It is okay to ask why an auditor needs something, and that question can at times even help identify better information or methods for an audit.
- We’re on the same team!
You can expect intermittent updates during an audit, including information about any identified issues. This is the time to flush out facts and ensure everyone is on the same page regarding the audit process and potential issues. Ideally, University personnel should provide responses to issues during the audit, with a closing meeting to confirm common ground on everything. You can also expect to receive a draft report to review and an opportunity to provide feedback before the final report is officially finalized and distributed. Final audit reports are distributed to the President of the University, Vice President for Finance and Administration, University administration with responsibility over the particular area subjected to the audit, and other University officials and University personnel deemed appropriate by the Chief Internal Auditor. In addition, the State of Illinois Auditor General has access to all audit reports. Audit reports and audit work papers are exempt from external disclosure under the Illinois Freedom of Information Act.
Subsequent to the issuance of the final internal audit report, the internal audit department will follow up on all actions to be performed or implemented by University administration in response to reported issues, and this follow-up may include re-audits of certain areas.
How Audits are Selected
The University’s internal audit department proposes a flexible plan of audits approved by the President annually. This plan sets forth the audits to be performed in a two-year period, and is derived from a prioritization of functions, processes, and concepts based on State requirements and risk. Risk is assessed based on the potential impact an area or concept could have on the University’s operations, or its importance to the University in achieving its mission and strategic plan. A risk assessment is highly judgmental and involves input from University personnel. Some areas may be audited every year, while minor functions, processes, or concepts may never be audited. Ultimately, the decision to audit anything is the result of significant efforts in risk assessment and compliance with State regulations.
Can I Request an Audit?
Yes, you can request an audit. Ideally, such requests can be made directly to the Chief Internal Auditor or the Vice President for Finance and Administration. You can also make requests through the University Counsel or the hotline. All requested audits would be considered in the same process as any other potential audits, weighing the risk and any other requirements. If the risk and any other requirements result in a more significant prioritization than the planned audits, your requested audit may be performed in lieu of another audit. Alternatively, if your requested audit is not assessed at a high enough priority, it may still be reconsidered at a later time. There are hundreds of possible audits, and the optimal prioritization is crucial for the University to comply with State regulations and cover the most significant risks.
