What to Expect if you are Audited Susan Fleener, 10/18/06

Intro to Internal Audit □Direct report to President □Mission: To provide the University with an independent appraisal of it's financial, operational, and control activities. □Link to Audit docs:

Intro to Audit Staff □12 staff - With various certifications: CPA, CIA, CFE, CISA □System-wide with staff located at BL, IUPUI, and SB □Link to Internal Audit org chart □Audit team will be 1- 4 staff

How does a unit get on “the list”? □Annual audit plan □Fraud, allegation, etc. □Change in Dean, Director, Chancellor, etc. □Request □Required by external – ex: NCAA

The Audit □Preliminary – Meet staff, do the research, obtain docs □Fieldwork – Create plan to test areas noted in Prelim. □Report – Findings and recommendations □Follow up – 12 months after Report □Audit Process link –

Audit Process - Prelim1 □Announcement Letter - objectives, time frame, audit team □Entrance Meeting - Meet the staff, discuss plan, identify contact person and time line. □Overall risk assessment – □Risk = things that can go wrong

Audit Process – Prelim2 □Request of documents □Organization chart □Job descriptions – basic info on who does what □Procedures manuals, if available □List of all sources of funds/revenues □List of physical locations □Financial statements □Recent reviews by IU or external

Audit Process - Prelim3 □Audit staff will contact relevant admin depts for information – Treasury, FMS, C&G, Auxiliary, Risk Management, etc. □Review IUIE reports □Payroll transactions □Expenditures/revenue transactions □Vendor □Accounts Receivable □5 year account balance analysis

Audit Process - Prelim4 □May send questionnaire to unit, audit staff will review and discuss with unit □After review of unit provided doc, questionnaire and standard IUIE reports: □Meet with staff to document process and controls* □Discuss any issues noted in review □Observe staff and overall operation

Audit Process – Prelim5 □Based on prior work, note areas that: □may be of concerns due to type of process, ex: large amounts of cash □may be missing needed controls, ex: reconciliation, review, approvals, separation of duties □Conclude in the Risk Assessment

Red Flags – Things that catch our eye. □Fluctuation in balances over 5 years □Account use – ex. 68-clearing □Object code use – ex □Negative balances – cash, expenditures □Collection of cash □Overtime – patterns and/or lots of it □Lack of PTO □Travel and P-cards □Lack of physical security for confidential data

Questions?

Audit Process – Fieldwork1 □Test of Transactions* □Payroll □Patterns or unusual overtime □Time sheets, PTO card, etc. □We trace the pay received to the supporting docs – time card, overtime approval, etc. □Disbursements □Sample of transactions – review of supporting docs □Travel and the Travel card – review for appropriate approval, business reason, receipts □P-card – reconciliations, receipts, business use

Audit Process – Fieldwork2 □Test of Transactions - continued □Revenue □Types of funds received, method revenue collected □Review collection process □Review deposit process – follow several days from receipt of funds to GL □Review reconciliations □Capital Assets □Review of asset inventory □Trace assets to the CAMS list □C&G □Select sample of transactions to verify if allowable on grant.

Audit Process – Fieldwork3 □Other □Information Systems □Specialized review of overall IS for the unit – this is done by our IS Auditor □Operations □Throughout the audit, opportunities to enhance efficiency may arise. □Physical security for staff, assets and data □Overall assessment of security

Audit Process – Fieldwork4 □Findings – Issues found that need to be changed, improved or corrected □Determine the materially of each finding □Several minor findings in one area may indicate a larger problem □Findings are “weighed” by: $$, safety, public relations effect, likelihood of occurring □Recommend a corrective plan and solicit a corrective action plan from the unit □Levels of Findings □Report □Management Letter □Verbal

Audit Process – Reporting1 □During the audit, Interim Audit Communications may be used to discuss findings and solicit corrective action plan □The draft report is a compilation of: □report-level findings □Internal Audit recommendations □Unit action plan responses □The draft will be sent to the unit for review and discussion at the exit meeting. □The draft report is almost always edited due to discussion between the unit and audit staff.

Audit Process – Reporting2 □After edits and conversation with the unit, the draft report will be finalized and sent out. □Final audit reports go to: □President □Board of Trustees □Relevant University Administrators □Chain of management for the unit □Related departments that have been identified in the report

What do you need to do? □Up to date? □Organization chart □Job descriptions □Procedures manuals □If requested, can you produce the list of documents? □Is there “proof” that the process works as written in the procedure manual?

Questions?

Wrap Up □Questions, concerns, comments – give us a call or . □Kate Bowman – Admin Asst □ □Susan Fleener ; □We are available.