UK Internal Audit’s (UKIA) audit process utilizes a collaborative approach to assess governance and operations to evaluate the effectiveness and efficiency of the controls in place to mitigate risk. The steps are outlined below.
Audit Process
Audit Process
Work Priorities
UKIA engages an annual risk assessment process to develop a Work Priorities program for the year. Our Work Priorities determine the types of reviews to be performed and the areas in which they will focus. Unplanned activities are determined through concerns expressed by management, Comply Line calls and other direct contacts.
Audit Notification
All reviews, except inquiries and investigations, commence with a letter to management notifying them of the upcoming audit. This notification letter communicates the audit type, preliminary objectives and tips (see below) on how the unit can assist the audit team.
Planning
During the planning phase, UKIA's consultants gather information and conduct research to gain a thorough understanding of the unit or process under review in order to tailor an audit plan and scope that are specific to that particular review.
Fieldwork
The fieldwork phase consists of the collection, documentation, and analysis of data as well as observational walkthroughs and interviews to validate policies and practices against federal, state and university regulations, business procedures and industry standards.
Reporting
The reporting phase ensures the effective communication of the results so that management is duly informed and can develop a Management Action Plan (MAP) that will effectively remediate the noted risks. Reporting typically has three phases: the closing meeting, draft report and final report. The final communication usually contains:
- Observations – The identified weaknesses that require management's attention.
- Recommendations – UKIA's set of proposed actions that will help management to address the noted conditions and improve operations.
- MAP – Included in the final report, this details the steps management intends to take to address the condition(s), including a timeline for completion.
Check-ins
Approximately 90 days following the distribution of the final report, UKIA will check in with the client to hear about the progress that the unit is making on its MAP and to see if there are any challenges or obstacles with which we may assist or provide guidance.
Follow-up
UKIA performs a review, as needed, after completion of the audit to assess the status of the observations. We then issue a report of the present status of the observations. If necessary, we will continue to follow up on all audit observations until they have been satisfactorily addressed.
Tips for a Successful Audit
Our mission is to support UK in its pursuit of excellence by providing expert analyses and advice to champion the achievement of institutional objectives. We aim to help you manage your operation more effectively while ensuring compliance with University, state and federal regulations. We make every effort to be considerate of your time and to minimize disruption during the review of your unit/department. In so doing, here are some important things you can do to facilitate the audit process:
- Have personnel available for interviews, observations, or walkthroughs. If possible, provide a space where the audit consultants may work and conduct interviews. Please note that, in order to facilitate a thorough, accurate and objective review, all interviews conducted by UKIA—including who and what was communicated—are strictly confidential.
- Review the audit objectives presented for your unit in the announcement letter. Feel free to ask questions if you do not understand why certain activities have been included or excluded.
- Share any related concerns you have with the auditor(s).
- Make all pertinent information, such as data, records, and technology resources available to the auditor(s).
- Supply all requested information on a timely basis.
- Review the preliminary audit results at the closing meeting with UKIA and recommend clarifications or corrections at that time.
- Based on the review type, a formal Management Action Plan (MAP) may be required. In such cases, develop a MAP to be incorporated into the final audit report that takes into account available resources and expertise. Implement the plan and monitor for compliance.
- As part of our Work Priorities, UKIA will return for a follow-up evaluation to check progress on remediating any findings noted during the initial review.