UNF Internal Auditing

The audit process is typically broken down into three functions: Planning, Fieldwork, Reporting and Followup. To learn more about an area, hover over the title and read the description in the box below.

An audit is an examination and analysis of an organization, program, function or activity. The Office of Internal Auditing (OIA) at UNF assists management in its effective discharge of managerial responsibilities by conducting audits of University functions in a professional, objective, and comprehensive manner. Audits are typically broken down into three parts (planning, fieldwork, and reporting & follow up). These elements of the process are discussed below.

Planning Risk Assessment Risk Assessment:Risk Assessment is the identification and analysis of relevant risks linked to the achievement of organizational objectives. The purpose of identifying and analyzing those risks is to determine how they can be managed. After identifying objectives and risks that could impede the achievement of objectives, management must next decide how to deal with the risks. Management may decide to control, transfer or accept the risk. Not all risks are created equal. Some are more likely to occur than others while some have a greater impact. Therefore, management must consider the likelihood of occurrence and the potential impact for all risks identified. These factors will ultimately drive the decision on how to handle the risk. Each department at UNF faces its own unique set of risks and must assess its risks in order to achieve departmental objectives. Effective and reliable internal controls can mitigate risks. The Office of Internal Auditing provides assistance to management in developing a Risk Methodology which can lead to strong internal controls. Finally, it is important that the Department of Internal Auditing's resources be allocated in such a manner so as to provide coverage to areas with the greatest risk exposure. As a result, UNF's internal auditors perform a much higher level of risk assessment with the help of management. This assessment is designed to ensure appropriate allocation of audit resources. Performance & Events Recent Events: The Office of Internal Auditing may monitor performance statistics for certain University functions (i.e. revenue trends for auxiliaries, attrition, expense trends). These trends, along with the risk assessment, may further define what areas are to be audited for a given year. Additionally, UNF's internal auditors may look at current events such as industry and/or University news articles, changes in key management, etc. Monitoring current events assists the department in staying abreast on University functions and issues as well as shape the annual audit plan. Policies & Procedures Policy/Procedures: A solid set of policies and procedures provide an excellent beginning for developing effective and reliable internal controls. Additionally, they keep employees aware of departmental expectations. Auditors may occasionally request a copy of policies and procedures, especially during the planning phase, to gain a better understanding of departmental functions. Planning Meeting Planning Meeting: The Office of Internal Auditing typically schedules planning meetings for areas that have been selected for audit. These meetings are different than information gathering meetings in the fact that the objective is to discuss the upcoming audit engagement. Items discussed typically include department performance, management concerns, timing of the engagement, engagement scope, etc. The meetings are intended to be an open and honest two-way discussion as the goal of an internal auditing is to ensure the University's resources are adequately and efficiently utilized. Additionally, meetings provide management with the opportunity to gain reasonable assurance that established goals, objectives and processes are being accomplished as intended (i.e. employees are performing functions as management designed them and/or as policies dictate). Information Request Information Request: The Office of Internal Auditing may request information from a department prior to, during and/or after a planning meeting. The acquired information will provide the auditors with a better understanding of departmental functions. Any information requested is kept strictly confidential. The nature of the auditing profession lends itself to viewing sensitive information on a regular basis. Therefore, you can rest assured that your department’s information will not be used in a manner that is detrimental to the University. Setting The Scope Setting the Scope: The Office of Internal Auditing sets the initial scope for audit services based on the information obtained in the planning phase. This scope is always a best effort to identify the audit objectives, however, it is always subject to change. Changes in scope may be due to a variety of reasons and are mostly dependent upon the actual activities of the department and how much they deviate from activities noted during the planning phase. The Office of Internal Auditing will make every effort to keep management up to date with regard to changes in scope.	Fieldwork Entrance Meeting Entrance Meeting: Typically there is an “entrance meeting” prior to the beginning of every audit. This is simply a kick-off meeting to discuss the scope and objectives, timing, availability of personnel, space allocation, etc. A majority of the items may have been discussed previously during the planning phase, however, this is an opportunity to revisit any open items and discuss new ones. Personnel Interviews Personnel Interviews: During the audit, it may be necessary for auditors to speak with personnel who perform certain functions. This is an essential part of any audit. The most effective method of understanding and evaluating a process is through direct interaction with personnel performing the function. These interviews provide reasonable assurance that staff members are performing their duties in a manner consistent with the policies and procedures that management provided to them. If not, the interviews provide an excellent opportunity to gain an understanding as to why the duties are not consistent with management's policies and expectations. Process Observation Process Observation: In addition to and/or instead of personnel interviews, it is oftentimes advantageous to directly observe processes. This typically involves sitting with personnel and observing them as they perform certain processes. The purpose of this is to ensure a complete understanding of the processes and procedures in place. Additionally, this helps to further define the scope and the nature of items that will be selected for detailed testing. Document Request Sampling Testing Exception Evaluation Exception Evaluation: No process is perfect. Each audit test performed will most likely yield exception items. However, as is the case with risks, exceptions are not created equal. With the help of management, auditors must determine the significance of exception items. For example, an error rate of 2 out of 200 items tested most likely does not pose a significant departmental risk. However, an error rate of 100 out of 200 (50%) may signify a breakdown in internal controls surrounding the specific process. Each exception item must be evaluated separately as well as in combination with other items noted during the audit. The goal is to determine if the department’s objectives are at risk and the extent to which they may be at risk, not necessarily to tally every exception item.	Reporting & Follow up Audit Issues Audit Issues: Audit issues are typically the results of tracking, categorizing and analyzing exception items. Issues are items that will be included in a formal audit report. When included in a report, issues are accompanied by recommendations to reduce/mitigate the risk posed by the issue. Additionally, management is responsible for formulating an action plan to address the issues and recommendations. There are usually several options available. Management can always implement an action, not necessarily the recommendations from audit; or management can do nothing and effectively accept the level of risk posed by the issue. In either case, management is required to document the decision. Additionally, if an action is to be implemented, a targeted completion date must be included. The Draft Report The Draft Report: A draft report will be distributed to relevant management personnel involved in the audit shortly after audit conclusion. Distributing the draft to management first in this manner provides the opportunity for both parties to discuss any issues and concerns prior to full distribution. Oftentimes there may be some loose ends that require further clarification and discussion. Exit Meeting Exit Meeting: The purpose of the exit meeting is to discuss the draft report and any other open items that could possibly hinder the closeout of the audit engagement. Shortly after the exit meeting, the Office of Internal Auditing will forward the updated (if necessary) report to management for response. Report Distribution Report Distribution: The final report is distributed to relevant parties once business unit management has responded to the issues presented. Relevant parties include but are not limited to: The President The Chief of Staff The CEO The VP in charge of the unit audited The Director of the unit audited Satisfaction Survey Satisfaction Survey It is the Office Of Internal Auditing’s goal to provide the best service possible to our clients. Therefore, we solicit feedback after each audit engagement. Our audits are performed in an objective manner and we would appreciate objective feedback. We are constantly trying to improve what we do and how we do it. Follow Up Follow Up The Office Of Internal Auditing tracks all open items and performs follow up on issues and recommendations based on the management-determined target completion date. Follow up is performed not only for internal audit issues, but for issues arising from audits performed by other groups. The purpose of the follow up is to determine what action has been taken in regard to the issues presented. In some instances, the issues are resolved with new processes, procedures, etc. In other instances, an extension may be required to implement an action. And occasionally, a department’s function may have change to a point where the initial item is no longer an issue.