What to Expect if you are Audited

Susan Fleener, 10/18/06

Intro to Internal Audit

□Direct report to President □Mission: To provide the University

with an independent appraisal of it's financial, operational, and control activities.

□Link to Audit docs: http://

www.indiana.edu/~iuaudit/publications.html

Intro to Audit Staff

□12 staff - With various certifications: CPA, CIA, CFE, CISA

□System-wide with staff located at BL, IUPUI, and SB

□Link to Internal Audit org charthttp://www.indiana.edu/~iuaudit/orgchart.html

□Audit team will be 1- 4 staff

How does a unit get on “the list”?

□Annual audit plan□Fraud, allegation, etc.□Change in Dean, Director,

Chancellor, etc.□Request □Required by external – ex: NCAA

The Audit

□Preliminary – Meet staff, do the research, obtain docs

□Fieldwork – Create plan to test areas noted in Prelim.

□Report – Findings and recommendations

□Follow up – 12 months after Report □Audit Process link – http://www.indiana.edu/~iuaudit/process.html

Audit Process - Prelim1

□Announcement Letter - objectives, time frame, audit team

□Entrance Meeting - Meet the staff, discuss plan, identify contact person and time line.

□Overall risk assessment – □Risk = things that can go wrong

Audit Process – Prelim2

□ Request of documents□ Organization chart □ Job descriptions – basic info on who does

what □ Procedures manuals, if available□ List of all sources of funds/revenues □ List of physical locations□ Financial statements□ Recent reviews by IU or external

Audit Process - Prelim3

□Audit staff will contact relevant admin depts for information – Treasury, FMS, C&G, Auxiliary, Risk Management, etc.

□Review IUIE reports□Payroll transactions□Expenditures/revenue transactions□Vendor □Accounts Receivable□5 year account balance analysis

Audit Process - Prelim4

□May send questionnaire to unit, audit staff will review and discuss with unit

□After review of unit provided doc, questionnaire and standard IUIE reports:□Meet with staff to document process

and controls*□Discuss any issues noted in review□Observe staff and overall operation

Audit Process – Prelim5

□Based on prior work, note areas that:□may be of concerns due to type of

process, ex: large amounts of cash□may be missing needed controls, ex:

reconciliation, review, approvals, separation of duties

□Conclude in the Risk Assessment

Red Flags – Things that catch our eye.

□Fluctuation in balances over 5 years□Account use – ex. 68-clearing□Object code use – ex. 8119□Negative balances – cash, expenditures□Collection of cash □Overtime – patterns and/or lots of it□Lack of PTO□Travel and P-cards□Lack of physical security for confidential

data

Questions?

Audit Process – Fieldwork1

□Test of Transactions*□Payroll

□Patterns or unusual overtime□Time sheets, PTO card, etc.□We trace the pay received to the supporting docs –

time card, overtime approval, etc.

□Disbursements□Sample of transactions – review of supporting docs□Travel and the Travel card – review for appropriate

approval, business reason, receipts□P-card – reconciliations, receipts, business use

Audit Process – Fieldwork2

□Test of Transactions - continued□Revenue

□Types of funds received, method revenue collected□Review collection process □Review deposit process – follow several days from

receipt of funds to GL□Review reconciliations

□Capital Assets□Review of asset inventory□Trace assets to the CAMS list

□C&G□Select sample of transactions to verify if allowable on

grant.

Audit Process – Fieldwork3

□Other□Information Systems

□Specialized review of overall IS for the unit – this is done by our IS Auditor

□Operations□Throughout the audit, opportunities to

enhance efficiency may arise.

□Physical security for staff, assets and data□Overall assessment of security

Audit Process – Fieldwork4

□Findings – Issues found that need to be changed, improved or corrected□Determine the materially of each finding

□Several minor findings in one area may indicate a larger problem

□Findings are “weighed” by: $$, safety, public relations effect, likelihood of occurring

□Recommend a corrective plan and solicit a corrective action plan from the unit

□Levels of Findings□Report□Management Letter □Verbal

Audit Process – Reporting1

□During the audit, Interim Audit Communications may be used to discuss findings and solicit corrective action plan

□The draft report is a compilation of:□report-level findings□Internal Audit recommendations□Unit action plan responses

□The draft will be sent to the unit for review and discussion at the exit meeting.

□The draft report is almost always edited due to discussion between the unit and audit staff.

Audit Process – Reporting2

□After edits and conversation with the unit, the draft report will be finalized and sent out.

□Final audit reports go to:□President□Board of Trustees□Relevant University Administrators□Chain of management for the unit□Related departments that have been identified

in the report

What do you need to do?

□Up to date?□Organization chart □Job descriptions □Procedures manuals

□If requested, can you produce the list of documents?

□Is there “proof” that the process works as written in the procedure manual?

Questions?

Wrap Up

□Questions, concerns, comments – give us a call or email.□Kate Bowman – Admin Asst 855-3361□http://www.indiana.edu/~iuaudit/□Susan Fleener 855-5372;

fleener@indiana.edu□We are available.