Back to Top

The Audit Process

Preparing for an Audit

The following steps offer some advice on preparing for an audit. This guidance is designed to make our audit process run more smoothly, minimize the amount of time we are on-site, limit the disruption to your operations and increase the likelihood of our work providing reliable outcomes. The information outlined below gives some guidance on the steps that you can take before we start the audit:

  • We're on the same team!! Cooperation on the part of the client and auditor are essential to a successful audit. In conducting planned audits, our purpose is to identify opportunities for improvement, which are in the best interests of both the University and the area being audited.
  • Assemble appropriate and current background information about your unit that you think might help us with the review. As a general guide, our work is focused upon the aims and objectives identified in your strategic plan so copies of the plan would be helpful. Other information might typically include any key procedures or policies, organization charts and financial information such as budgets and sample management reports. Copies of these documents are particularly helpful.
  • If your area has been audited in the past by our division, it is worth reviewing the last audit report. A standard feature of our approach is to review the progress of past recommendations. It is also useful if you can make us aware of, or provide us with the information of any other reviews or inspections that have taken place in your unit.
  • Assign temporary workspace to the auditor(s) within reasonable proximity to the office staff and records since many of the original documents and records we will need to examine are located at the local department level. We will attempt to perform as much of the audit as possible from our office so as to minimize any disruption of your operations.
  • Prior to starting an audit we hold a planning meeting with you to identify the scope of the audit. This meeting covers the key areas of the audit relating to its objectives. You may want to consider which staff should be present. In particular, we often find it helpful for someone at the meeting to provide us with an overview of the unit's work.
  • Identify an 'audit contact' person who can act as a liaison person to work with us. This member of staff should be responsible for ensuring that we have access to records and files or any other resources we need to complete our reviews as well as directing us to the appropriate personnel who can help us complete specific areas of our review. This person normally acts as our main point of contact as the audit progresses so that we can continue to keep you informed of how the work is going.
  • Tell your staff about the audit. As part of our planning, we provide you with the scope and objectives of the audit. By notifying the affected unit, they will know to expect us to be around the unit and have an idea of the type of work we will be undertaking. It also helps those staff that we need to contact to identify the sort of records and information that they need to have available when we meet with them.
  • Please note that these are only general steps recommended to prepare for an audit. We recognize that specific steps and information requests that are unique to your unit will be identified and communicated to you as part of the initial contact and planning meeting with us.
  • Finally, please ask us if you have any doubts or queries about the work that we will be doing or are planning to do. We would like this to be a pleasant and informed experience as possible.

Getting Audited

Each audit is unique and can take from weeks to several months to complete depending on the objectives and complexity of the review. Once your department or function has been selected for audit, your audit will follow four general stages: Planning, Fieldwork, Audit Report and Follow-up. If you are selected for an audit the following will generally be the process:


    I. The Audit is announced through an engagement letter

    Internal Audit notifies the President and area to be audited, in writing.


    II. Entrance Conference

    An Entrance Conference will be held with the client prior to our beginning actual audit fieldwork. Participants in this meeting will include appropriate management representatives as well as other relevant personnel that have knowledge of the process or department being reviewed. Management may identify specific personnel with knowledge of the area under review who should participate in the Entrance Conference. During the Entrance Conference the auditor and client will discuss:

    • Objective and Scope of the review
    • Timing of the audit
    • Contact persons/departments
    • Management Concerns
    • Current Practices

    If you have particular questions or concerns you would like us to review during the audit, you can raise these at the entrance conference, so we can adjust our program to include these areas.


    III. Planning

    During the planning phase, the auditor establishes the detailed audit program and procedures that will be conducted during the scheduled engagement. Audit procedures are designed to meet the audit objective and scope established for the review.

    The auditor obtains a general understanding of the department or process being audited. Typical audit planning activity includes:

    • Review of existing policies, procedures, applicable regulations and laws.
    • Discussion with Financial Operations, Office of the General Counsel or other relevant areas.
    • Obtaining background or historical information regarding organizational and/or departmental performance
    • Analysis of potential risks
    • Communication with the client.

    During the planning phase audit staff may utilize questionnaires, surveys or other tools to obtain an understanding of existing procedures and/or controls.


    IV. Fieldwork

    During audit fieldwork, auditors will collect, analyze, interpret and document policies, procedures and transactions within an organizational unit. Auditors will perform their work in accordance with the audit program. It should be noted that during the course of fieldwork, internal control weaknesses may be identified that fall outside the original objective and scope of the review. Internal Audit is responsible to report these issues to management to ensure their appropriate disposition and resolution.

    Auditors will perform their work in an efficient manner that minimizes department interruptions. Meetings will be scheduled in advance, when possible, and requests for information will be provided to management to facilitate the timely and orderly collection of data.

    Interim meetings and updates will be provided throughout the audit to communicate the progress of the audit as well as observations to date. Departmental personnel will have the opportunity to provide input regarding observations and recommendations during the review.


    V. Exit Conference is held

    After the conclusion of fieldwork a preliminary exit conference is held to discuss the audit findings and the suggested recommendations. After this meeting, the auditor completes work paper documentation and prepares a draft of the audit report. This draft is provided to the department for review, and a final exit meeting is scheduled to discuss the report and the findings. Internal Auditing requests that the responsible management official provide a written response to each recommendation, to state whether or not the department agrees with the recommendations, the plans for implementation, including a timeline, and any other information to explain the issues.


    VI. Report

    The Internal Auditing Department publishes the final audit report with management responses. The report is addressed to the President of the institution with copies of the report distributed to the Board of Governors of the Colorado State University System Audit Committee, department officials and others responsible for findings and recommendations in the report, the University's audit liaison, and any other officials deemed appropriate by the Internal Auditing Department.


    VII. A Follow-Up Review is Conducted

    Internal Audit will conduct follow-up procedures to ensure corrective measures have been implemented in a timely and effective manner. Follow-up procedures are generally performed 6 months after the publication of the report, or based on the target date for implementation.. A summary of open audit recommendations is provided to the Board of Governors on a periodic basis.

Internal Audit

Candice Bridgers, Audit Manager


Back to Top