The Internal Audit Process

Purpose

To provide a general overview of the internal audit process.

Background

Although every audit is unique, the audit process is similar for most engagements and normally consists of four stages: Planning, Fieldwork, Reporting and Follow-up.  BCPSS personnel’s involvement is critical at each stage of the process, which involves a collaborative effort from departmental or school personnel, and the internal audit staff.  We realize that a certain amount of time is diverted from regular routines as a result of an audit; therefore, one of our key objectives is to minimize the disruption of operations by performing the audit in a timely and efficient manner.

Listed below are 12 steps that are performed to achieve the audit objectives.

1. Audit Planning

Each school year, the internal audit director performs a risk assessment of the BCPSS operations, activities and schools.  The assessment is based on a variety of factors, such as the BCPSS Master Plan objectives, current and potential dollar risk impact, adequacy of internal control procedures, prior audit findings, complaints or concerns and the availability of audit resources.  An annual audit plan is then developed, reviewed and approved by the Board.  The audit plan tends to be ongoing and dynamic, since the focus and timing of many audits can evolve into new issues, which results in shifting or modifying audit priorities.

2. Audit Notification

The department head or officer is informed of the audit through an internal announcement (via email) from the internal audit director.  The announcement communicates the time period on which the audit is expected to commence, and the scope of work.

3. Introductory Meeting

During the introductory meeting, the internal audit director, audit manager and audit staff meet with the department head and/or manager directly responsible for the department that is under review.  The internal audit director or the auditor in-charge discusses the audit scope and objectives, obtains from management an overview of the department under review, and identifies the names of key departmental personnel.  The meeting is also an opportunity for the department head and/or manager to discuss issues or areas of special concern that may require audit attention.

4. Internal Control Review

The auditor in-charge will review the department’s internal control structure.  To perform this review, the auditor uses a variety of tools and techniques to gather and analyze information about the department’s operations.  These tools and techniques may include inquiries with department personnel who actually perform the job tasks, an examination of documentation used for transactions processing, and the review of the department’s information system(s).  This review of the department’s internal control structure helps the auditor to determine the areas with the highest risks.

5. Transaction Testing

This phase concentrates primarily on the testing of critical procedures and transactions performed by the department on a regular basis.  It involves examining records for proper compliance with established policies, procedures, rules and regulations, which may include, reviewing documents for proper approvals, examining transactions for adequate supporting documentation, and testing financial data for accuracy.  During this phase, the auditor determines whether the controls identified during the internal control review are operating properly.

6. Communication

As the fieldwork progresses, the auditor periodically discusses any significant audit findings with the department head or manager.  The purpose for an ongoing discussion is for the department head or manager to offer insight into the details, cause, and risk factors surrounding the issue and to work with the auditor to determine the best method of resolving the audit finding.  Usually these communications are oral.  However, in more complex situations, memos and/or emails are written in order to ensure full understanding by the department head or manager, and the auditor.  Our goal is to ensure a clear understanding of the finding and its resolution.

7. Audit Findings and Recommendations

To ensure that the audit findings and recommendations are presented accurately, the audit staff discusses the findings and recommendations with the department head, manager and/or other appropriate personnel prior to the issuance of the audit report draft.

8. Audit Report Draft

At the close of fieldwork, the internal audit director will review, in detail, all findings and recommendations along with the supporting documentation with the auditor in-charge prior to the issuance of the report draft to the department head or officer. 

9. Exit Conference

After the department head or officer has received and reviewed the audit report draft, a meeting to discuss the findings and recommendations is held.  During the meeting, the findings are discussed along with the effects as they relate to established policies, procedures, applicable laws and regulations, and sound management practices. 

10. Management’s Response to Audit Findings and Recommendations

The department head or officer is required to respond to the audit findings and recommendations in writing.  The written responses will be included in the final audit report.  In the written responses, the department head or officer should explain how the findings will be resolved and include a time frame to resolve the concerns.  The response to the audit report must be addressed to the internal audit director and sent to the Office of Internal Audits, located at the BCPSS Central Administration building.

11. Issuance of the Final Audit Report

The internal audit director prepares a final audit report, taking into account any revisions resulting from the exit conference and other discussions.  A final audit report is issued when the Board Executive has reviewed and approved changes or modifications.

The final audit report is distributed to the CEO, members of the Board and selected members of executive management.  The audit report is primarily for internal use.

12. Follow-up Review

A follow-up review may be performed in order to verify the resolution of the report findings.  The corrective actions described by the department head or officer to resolve the findings may be tested to ensure that that the desired results were achieved. 

The review will conclude with a follow-up report, which lists the actions taken by the department head or officer to resolve the original reported findings.  Unresolved findings will appear in the follow-up report and will include a brief description of the initial finding and recommendation, management’s initial response, the current condition and risk exposure.  The follow-up report will be issued to the recipients of the initial audit report, and other officials as deemed appropriate.