Audit Follow-Up Policy
From Appalachian State University Policy Manual
- 1 Introduction
- 2 Scope
- 3 Definitions
- 4 Policy and Procedure Statements
- 5 Additional References
- 6 Authority
- 7 Contact Information
- 8 Original Effective Date
- 9 Revision Dates
4 Policy and Procedure Statements
4.1 Follow-up On Audit Findings
4.1.1 Follow-up on audit findings of the State Auditor and Internal Auditor is defined as the action taken to correct a weak control situation that has been identified and reported to the University administration. The action may stem from a decision taken by administrators during the course of the audit or from a recommendation made by Internal Auditors or State Auditors.
4.1.2 The responsibility for follow-up is that of University administrators. Every audit should receive a response, and every audit finding should be resolved. If the manager/director of the audited area agrees with all of the findings, the audit report will note this and include dates of implementation where possible. If an audit recommendation is challenged by the manager/director of the area, then the Internal Auditors and the State Auditors will attempt to resolve the matter. If they are not successful, senior administrators must review and attempt to resolve the matter.
4.1.3 The audit report or transmittal will include a request for a written reply regarding corrective actions, taken or planned, for each unsatisfactory audit finding. The Director of Audits will maintain records of audit recommendations and corrective action. The Director will report to the Chancellor on the status of the State and internal audit findings.
4.2 State Audit Findings
4.2.1 The Director of Audits will confer and send copies of the State audit findings to the Vice Chancellors of the areas with the audit deficiencies. He will ask that the audit findings be discussed with the manager/directors of the area and solicit their input for a response that can be used in the exit audit conference with the Chancellor and the State Auditor.
4.2.2 After the audit conference, the Director of Audits will work with the Chancellor in developing a response from the University as required by the State Auditor. This response is normally required within ten working days of the exit conference.
4.2.3 The Director will send a copy of the State audit finding with the University's response to each manager/director responsible for the area. A carbon copy of the memorandum will be sent to the appropriate Vice Chancellor.
4.2.4 The Office of Internal Audits will conduct a follow-up review of activities that had audit findings from the State Auditor. The follow-up will be done within three months of the date of the exit audit conference.
4.2.5 If the follow-up review indicates continued deficiencies that were pointed out in the State audit, the Director of Audits will attempt to have them corrected at the manager or director level. If this is not successful, the Director will issue a memorandum to the appropriate Vice Chancellor describing the situation and ask that the deficiencies be cleared with the manager/director of the area within thirty days.
4.2.6 This is an attempt to prevent repeat audit findings. If the State Auditor finds a repeat audit finding on the next audit, the Vice Chancellor will be asked to look into the circumstances and to give a report to the Chancellor.
4.2.7 The Chancellor and Vice Chancellor will review the situation to determine a course of action. The Director of Audits may be used as a resource person if needed. The Vice Chancellor will be asked to carry out the determined course of action with the appropriate personnel and to report back to the Chancellor. The Director of Audits should also be advised of corrective action taken and progress made toward clearing the audit deficiency. This will be helpful to the Director as he continues to work as a liaison to the State Auditor.
4.2.8 In rare occasions we may have an audit finding that will take more that one year to clear. If this should occur, we should be prepared to give a progress report and detail action taken on the part of the University.
4.3 Internal Audit Findings
4.3.1 After an internal audit is completed, an exit conference may be held with the manager/director of the audited department and the appropriate Vice Chancellor. The manager/director is asked to respond to the audit report findings and recommendations with a written audit reply within fifteen days of the conference.
4.3.2 The audit reply will be reviewed to determine that it adequately addresses the audit findings and recommendations. If the audit reply is inadequate, the Office of Internal Audits personnel will attempt to have the deficiencies corrected at the manager/director level. If this is not possible, the problem will be referred to the appropriate Vice Chancellor or Chancellor.
4.3.3 The Office of Internal Audits will conduct a follow-up review of the audited department to verify that the recommended procedures are in place and operating effectively. This will be done prior to the next scheduled State audit as the State Auditor requires a copy of all internal audit reports.
4.3.4 If the follow-up review indicates continued deficiencies, the Office of Internal Audits will attempt to have them corrected at the manager/director level. If this is not successful, the problem will be referred to the appropriate Vice Chancellor and the Chancellor.
4.3.5 In the event there are repeat audit findings on the next internal audit, the Director of Audits will work with the Vice Chancellor and the manager/director on the corrective action and resolution. The Director of Audits will issue a memorandum to the Chancellor advising of the situation and the final resolution of the problem.
4.4 Responding to Audit Report
Procedure Reference - Review Policy Statement 1, Internal Audits and Policy Statement 2, Information Systems Audits.
4.4.1 Procedure Description
18.104.22.168 To insure that consistent practices and procedures are followed regarding the correction of audit deficiencies, fiscal policy of the University requires a written reply to the audit report. This reply is due within fifteen (15) days of the date of the internal audit conference or fifteen (15) days of the date of the audit report for Information Systems audits.
4.4.2 Procedure Steps
22.214.171.124 Manager or Director of Audited Department Writes Memorandum of Reply to the Audit Report
- Address memorandum to the Director of Audits.
- Address each audit finding/error individually explaining what corrective action has been taken.
- Where applicable, describe any changes in operating procedures, etc. that would alleviate the problem in the future.
- Forward reply to the Director of Audits with a copy going to the Vice Chancellor responsible for the audited area within fifteen (15) days of the date of the audit conference or audit report.