Internal Audit Procedures and Standards

Procedure Administrator: Executive Vice President

Authority:

Effective Date: January 15, 2017

Index Cross-References:

Procedure File Number: 6421

Approved By: University President

The following Procedures and Standards document how the internal audit process is to be conducted, ensuring that work papers are well organized, clearly written, and address all areas within the scope of the audit. The work papers should also contain sufficient evidence of the procedures performed and support the conclusions reached.

The quality controls standards adhered to by Internal Audit are as follows:

1. Organization and Personnel:

a. The Internal Audit Department (IAD) may be outsourced to a third party, staffed by University personnel or a hybrid of both.

b. Internal Audit is independent of the area being audited or appropriate disclosure has been made in the report.

c. Each internal auditor receives at least 24 hours of continuing professional education (CPE) each year.

d. Internal Audit reports directly to the Audit Committee of the Board of Trustees (administratively to the Executive Vice President and Chief of Staff of the University) and regularly attends Audit Committee meetings.

2. Planning:

a. A written audit plan is prepared by the IAD. The audit plan is reviewed and approved by the Audit Committee annually.

b. The IAD prepares an audit risk assessment annually.

c. Monthly, Internal Audit meets with the Chairman of the Audit Committee to discuss open items noted in past reviews, trending risks and/or any items noted. (The Executive Vice President and Chief of Staff are kept informed monthly.)

d. Scope and objective statements are written for each audit conducted.

e. Written audit programs are used.

f. An approved staff time budget for each audit is utilized.

g. Background information about the activity to be audited is obtained and where appropriate, narratives, internal control questionnaire and/or flowcharts are utilized.

3. Documentation:

a. Narratives, internal control questionnaires, or flowcharts are used to document the systems of internal control.

b. For each project, Internal Audit prepares a control and risk evaluation.

c. Audit finding sheets, supported by work papers containing sufficient evidential matter, are used to document all findings included in a report.

d. A work paper retention schedule is used.

e. Adequate written evidential matter is included in the audit work papers to support the audit conclusions.

f. Standardized forms and checklists are used for planning, documentation, and reporting.

4. Review:

a. Work papers are reviewed by Internal Audit management.

b. A Quality assurance and improvement program (QAIP) is in place.

c. All internal audit reports are reviewed by Internal Audit management.

d. Any information technology related to internal audit reports are reviewed by the appropriate Internal Audit personnel with expertise in this area.

e. Internal auditors discuss and present each report and findings directly with the Audit Committee.

f. Findings noted by Internal Audit or other 3rd Party assessments are tracked by Internal Audit and followed up on based on the timeline set by the Audit Committee for each observation noted.

g. Internal Audit adheres to quality assurance standards.

Approval History:
President 1/18/2017