1. Selection of Engagement Area
  2. Planning & Notification
  3. Entrance Conference
  4. Fieldwork
  5. Communication
  6. Exit Conference
  7. Draft Report & Management Responses
  8. Final Report
  9. Follow-up

Selection of Engagement Area

Areas selected for an engagement are presented on the Internal Audit Department (IAD) Annual Plan. The plan is based upon input from university and system administration, State Board of Higher Education, and IAD staff.

Factors that are considered in selecting units include:

  • Results of the last engagement of the area and length of time since last engagement
  • The size and complexity of the operation
  • Potential risk of financial loss
  • Major changes in operation, program, systems, or controls
  • Highly regulated operations or operations subject to a high level of public scrutiny
  • Degree of manual and automated processing
  • Confidence in management
  • Sensitivity (image, reputation, political)
  • Assets
  • Profits
  • Sales
  • Employee turnover
  • Risk of loss
  • Other

Page Top

Planning & Notification

First, you will receive a letter to inform you of an upcoming engagement. The auditor will send you a preliminary checklist. This is a list of documents (e.g. organization charts, financial statements) that will help the auditor learn about your unit before planning the engagement. During the planning stages, the auditor will also ask you to identify potential objectives that would add value to your organization.

Page Top

Entrance Conference

At the beginning of each engagement, a meeting is scheduled with the unit head and other appropriate personnel to discuss the engagement scope and objectives, time schedule, and review process. Any concerns raised by the unit personnel are also discussed.

Page Top


After the entrance conference, the auditor will begin fieldwork. Fieldwork involves interviewing staff, reviewing policies and procedures, and performing detailed tests.

The emphasis of the evaluation is to determine if there are adequate control systems and whether the systems are functioning as intended. The controls are measured against system, state, and federal policies and procedures, as well as, generally accepted accounting principles. Areas of deficiency and potential recommendations are discussed with the appropriate staff and are documented in the engagement work papers. Auditors will also discuss control strengths identified within your unit.

Page Top


Throughout the process, the auditor will keep you informed. You will have an opportunity to discuss and confirm the potential problems found and possible solutions.

Page Top

Exit Conference

A meeting is scheduled with the same individuals who attended the entrance conference. At the exit conference, a rough draft of the report is reviewed so that all of the parties understand the nature of the recommendations and agree upon the possible solutions to any problem areas. Any misunderstandings or possible misstatements contained in the report are identified and resolved. Any deficiencies identified during the engagement, which were not significant enough to be included in the report, but still represent a potential risk, are also discussed.

Page Top

Draft Report & Management Responses

After the exit conference, a draft of the report is finalized. The manager of the activity or department receiving the report is encouraged to respond promptly. This response will indicate what actions were taken or are planned in regard to the specific findings and recommendations in the report. If appropriate, a timetable for the anticipated completion of these actions will be included.

Page Top

Final Report

The unit's responses are added and any noted corrections are made to the report. The final report is printed and distributed to the appropriate university officials.

Page Top


There will be a follow-up review approximately 6 to 12 months after the engagement. The purpose of the follow-up is to verify that you have implemented the agreed-upon corrective actions. The auditor will interview staff, perform tests, or review new procedures. The auditor will issue a follow-up memo indicating whether further actions are necessary. If further corrective action is required, you will need to identify what future corrective action is to be taken. Otherwise, you're all done.

Page Top