The Internal Audit Division understands that the prospect of an audit can sometimes be unsettling to City departments.  But the audit process doesn't have to be confusing.  IAD strives to make its audit process as transparent and understandable as possible.  Below you will find a general description of how an audit is conducted.

Audit Steps

A typical audit goes through the stages described below.  The amount of time needed for each step depends on the scope of the audit, the type of testing or reviews that need to be done, and the ease or difficulty of retrieving information.  Your auditor should provide you with a tentative timetable for the audit and keep you apprised of where he or she is during the process.

1. Audit Selection--Audits are identifies as a result of the biannual risk assessment and placed on the workplan approved by the Audit Committee.  Audits can also be conducted on an ad hoc basis as requested by departments, the City Manager, or Council.
2. Background Survey--The auditors familiarize themselves with the department or function being audited.  They review similar audits in other cities, identify significant risks or potential problems, and find best practices or benchmarks to gauge performance. The auditors also inform the auditee about the planned audit and set up the audit entrance conference.
3. Tentative Workplan--The auditors develop a preliminary plan for the audit, including its objectives, scope, methodology, and suggested work steps.
4. Entrance Conference--The auditors and audit manager meet with the auditee prior to starting fieldwork.  The purpose of the conference is to review the scope of the proposed work, to identify areas of concern, and to establish a constructive working relationship.  The auditors will review the workplan to explain and clarify the scope of the audit.  The auditee is encouraged to comment on the scope and objectives as well as to suggest additional areas for evaluation.   Click here to read IAD's Entrance Conference Policy.
5. Fieldwork--The auditors conduct the audit at the auditee's workplace.  The auditors will typically interview staff members and asked that key processes are explained.  The auditors will also carry out tests that were created in the workplan to provide reasonable assurance that internal controls are functioning properly.  All fieldwork is documented in electronic workpapers that become the basis for the conclusions reached in the audit.
6. Report Writing--The core of the report will be the auditor's findings, which are problem areas or opportunities to improve performance.  Each finding has recommendation(s) for action to correct the problem or improve operations.
7. Exit Conference--The auditee will receive a draft of the report prior to an exit conference.  The exit conference is a final meeting with the auditee to confirm the factual accuracy and fairness of the report draft and address any related concerns that department management may have.  If necessary, the report draft will be updated to reflect information shared at the exit conference and a new draft will be sent to the department.   Click here to read IAD's Exit Conference Policy.
8. Department Response--Once the draft report is finalized, the auditee has two weeks to draft a response.  Departments may respond that agree or disagree with each recommendation.  If the department agrees, it is encouraged to identify who will implement the recommendation(s) and when it will be carried out.  If the department disagrees, it should propose an alternative solution to the problem identified.   Click here for more guidances and examples of department responses.
9. Report Release--The department's response is included in the final report, which is then submitted to auditee management, the Audit Committee, City Manager, and City Council.
10. Audit Follow-Up--Follow-up audits may be conducted by the Internal Audit Division 6-12 months after the final report date and any audit exceptions will be reported to department management and the City Manager for further resolution. 

If you would like more information about IADs operations or how audits are conducted, please contact us.