Internal Audit Process
The stages of the audit process are:
During the Audit Planning phase, the auditor will:
- Obtain and review the agency’s standard operating procedure for a clearer understanding of the agency’s operations
- Research state and federal law requirements for the agency
- Research standard practices with similar municipalities
- Perform a risk assessment to assess what could go wrong
- Identify the scope of the audit, i.e., the audit areas of review, the period of review, and the audit objectives
- Initiate an engagement opening meeting with the auditee, i.e., management and staff involved in the audit, and discuss the identified audit scope, process, and plan, auditors’ expectations of the auditee during the audit, etc.
- The auditor will submit a document request to the auditee for documents needed for review during the audit. Please note that the list may not be inclusive; some other documents will be requested at the fieldwork.
- The auditor will outline the engagement milestone dates and submit them to the Manager or supervisor for review and approval.
Activities during the fieldwork will include:
- Conducting walkthroughs at the auditee’s site to observe and understand how the processes are carried out and to compare what was documented in the SOP with the actual realities.
- The auditor may interview the auditee to clarify some grey areas or to assist with understanding the process. Please note that these activities are not sequential; they will only be carried out where the auditor feels a need for them.
- To ensure the management of controls' existence, efficiency, and effectiveness, the auditor will review the controls established by management in mitigating risks inherent in its operations.
- The auditor performs various forms of reviews, which includes testing, due diligence, analytical reviews, compliance testing, and confirming or verifying statements made by management. This is the stage at which the auditors form an opinion on the audit based on the available evidence.
- The auditor documents their observations, findings, and conclusions.
At the reporting stage, the following will be done:
The auditor drafts their initial internal audit report. Please note that this report will be reviewed by the internal audit manager or the supervisor and shared with the auditee’s management for their review and to ensure they agree with all information to be reported in the audit. This helps to avoid surprises and undue sensitization of the audited agency. Where there are disagreements, the internal audit manager will request documentation/explanation/clarification from the auditee that clarifies any observations or conclusions that management does not agree with. The additional documents, explanations, and clarifications will be reviewed, and an opinion will be formed. The audit report will be amended if the auditor’s conclusion changes based on the additional information received. Where the additional information provided was insufficient to change the auditor’s disposition, the audit report will remain unchanged.
An exit meeting will be organized to agree on the recommendations and implementation plans for the audit findings, observations, and conclusions. The auditee will be asked to suggest an implementation timeline for all audit recommendations at the meeting.
The audit report will be sent to the auditee for their management responses to be documented on the report.
The audit report will be finalized and signed off by the audited agency’s director or head and counter-signed by the Finance department director.
The final audit report will be shared with the Mayor, Finance Committee, and the Common Council.
Finally, the auditor or the unit manager will follow up with the auditee on implementing the audit recommendations. Where there are issues or challenges in implementing the recommendations, the audit unit will work with the management to revise the expected implementation date and update the new date on its “Audit Findings/Recommendation” Tracking Sheet. Other support allowed within the internal audit process will also be provided by the internal audit unit but not perform management’s role