Internal Audit Process


  • An entrance conference will be scheduled with the auditable unit’s administration to communicate the preliminary audit process, seek administration’s input regarding risk and audit scope, gather preliminary information, and establish a cooperative working relationship with administration.
  • A series of interviews will be conducted focusing on the various audit areas. The purpose of the interviews is to document what procedures are done and why.
  • Based on the entrance conference, preliminary interviews, and preliminary analysis, audit procedures will be designed to address each identified audit risk.


  • In the fieldwork phase, Internal Audit seeks to gain an understanding of operations under review, assess the internal control structure, and perform detailed testing to verify compliance with policies and/or regulatory compliance standards.
  • When adequate internal controls are identified, walk-through tests will be performed to confirm that the tasks are performed as described.
  • When weaknesses in internal controls are identified, Internal Audit will work in collaboration with administration to design effective and efficient control recommendations.
  • Detailed audit procedures will be performed in areas of higher risk. The primary focus of these procedures is on testing for compliance with University, Board of Regents, State, and Federal policies, procedures, laws, and regulations.
  • Internal audits are intended to be collaborative projects. Administration will be notified promptly of any audit concerns in order to give adequate opportunity to provide insight regarding the respective issues.
  • All audit findings and recommendations will be discussed with the staff members and administration responsible for implementing the recommendations.


  • Upon completion of fieldwork, a draft of an audit report will be prepared and provided to administration for review and comment prior to publication.
  • Shortly thereafter, an exit conference will be scheduled with administration to discuss the audit and the report and obtain clarification. Active discussion and interaction with administration's input regarding the background, tone, findings, and recommendations prior to issuing the final report is standard protocol.
  • After the exit conference, administartion will be asked to formally respond in writing to any findings and recommendations.
  • Administration’s response will be incorporated into the audit report, and a final audit report will be issued to all required parties.


Frequently Asked Questions

The following will answer some of the questions frequently asked regarding the audit process.

How are departments and offices selected for audit?

Each year, Internal Audit prepares an audit plan based on administration's input and an assessment of each unit’s perceived audit risk.

How long do audits take?

The length of each audit depends on the depth and scope. Generally, full-scope operational audits will take approximately two months.

Who receives audit reports?

Audit reports are distributed to senior administration of the applicable department, the President, and the Chief Audit Officer / Associate Vice Chancellor of the Board of Regents.

What can I do to facilitate the audit process?

Be honest and open, and actively participate in the planning process and discussions. It is important that you not only voice your opinions regarding areas of weakness and issues of concern, but also give an honest assessment of the anticipated effectiveness and feasibility of proposed suggestions for improvement.