What to Expect if you are Audited

1. What to Expect if you are Audited Susan Fleener, 10/18/06

2. Intro to Internal Audit • Direct report to President • Mission: To provide the University with an independent appraisal of it's financial, operational, and control activities. • Link to Audit docs: http://www.indiana.edu/~iuaudit/publications.html

3. Intro to Audit Staff • 12 staff - With various certifications: CPA, CIA, CFE, CISA • System-wide with staff located at BL, IUPUI, and SB • Link to Internal Audit org chart http://www.indiana.edu/~iuaudit/orgchart.html • Audit team will be 1- 4 staff

4. How does a unit get on “the list”? • Annual audit plan • Fraud, allegation, etc. • Change in Dean, Director, Chancellor, etc. • Request • Required by external – ex: NCAA

5. The Audit • Preliminary – Meet staff, do the research, obtain docs • Fieldwork – Create plan to test areas noted in Prelim. • Report – Findings and recommendations • Follow up – 12 months after Report • Audit Process link – http://www.indiana.edu/~iuaudit/process.html

6. Audit Process - Prelim1 • Announcement Letter - objectives, time frame, audit team • Entrance Meeting - Meet the staff, discuss plan, identify contact person and time line. • Overall risk assessment – • Risk = things that can go wrong

7. Audit Process – Prelim2 • Request of documents • Organization chart • Job descriptions – basic info on who does what • Procedures manuals, if available • List of all sources of funds/revenues • List of physical locations • Financial statements • Recent reviews by IU or external

8. Audit Process - Prelim3 • Audit staff will contact relevant admin depts for information – Treasury, FMS, C&G, Auxiliary, Risk Management, etc. • Review IUIE reports • Payroll transactions • Expenditures/revenue transactions • Vendor • Accounts Receivable • 5 year account balance analysis

9. Audit Process - Prelim4 • May send questionnaire to unit, audit staff will review and discuss with unit • After review of unit provided doc, questionnaire and standard IUIE reports: • Meet with staff to document process and controls* • Discuss any issues noted in review • Observe staff and overall operation

10. Audit Process – Prelim5 • Based on prior work, note areas that: • may be of concerns due to type of process, ex: large amounts of cash • may be missing needed controls, ex: reconciliation, review, approvals, separation of duties • Conclude in the Risk Assessment

11. Red Flags – Things that catch our eye. • Fluctuation in balances over 5 years • Account use – ex. 68-clearing • Object code use – ex. 8119 • Negative balances – cash, expenditures • Collection of cash • Overtime – patterns and/or lots of it • Lack of PTO • Travel and P-cards • Lack of physical security for confidential data

12. Questions?

13. Audit Process – Fieldwork1 • Test of Transactions* • Payroll • Patterns or unusual overtime • Time sheets, PTO card, etc. • We trace the pay received to the supporting docs – time card, overtime approval, etc. • Disbursements • Sample of transactions – review of supporting docs • Travel and the Travel card – review for appropriate approval, business reason, receipts • P-card – reconciliations, receipts, business use

14. Audit Process – Fieldwork2 • Test of Transactions - continued • Revenue • Types of funds received, method revenue collected • Review collection process • Review deposit process – follow several days from receipt of funds to GL • Review reconciliations • Capital Assets • Review of asset inventory • Trace assets to the CAMS list • C&G • Select sample of transactions to verify if allowable on grant.

15. Audit Process – Fieldwork3 • Other • Information Systems • Specialized review of overall IS for the unit – this is done by our IS Auditor • Operations • Throughout the audit, opportunities to enhance efficiency may arise. • Physical security for staff, assets and data • Overall assessment of security

16. Audit Process – Fieldwork4 • Findings – Issues found that need to be changed, improved or corrected • Determine the materially of each finding • Several minor findings in one area may indicate a larger problem • Findings are “weighed” by: $$, safety, public relations effect, likelihood of occurring • Recommend a corrective plan and solicit a corrective action plan from the unit • Levels of Findings • Report • Management Letter • Verbal

17. Audit Process – Reporting1 • During the audit, Interim Audit Communications may be used to discuss findings and solicit corrective action plan • The draft report is a compilation of: • report-level findings • Internal Audit recommendations • Unit action plan responses • The draft will be sent to the unit for review and discussion at the exit meeting. • The draft report is almost always edited due to discussion between the unit and audit staff.

18. Audit Process – Reporting2 • After edits and conversation with the unit, the draft report will be finalized and sent out. • Final audit reports go to: • President • Board of Trustees • Relevant University Administrators • Chain of management for the unit • Related departments that have been identified in the report

19. What do you need to do? • Up to date? • Organization chart • Job descriptions • Procedures manuals • If requested, can you produce the list of documents? • Is there “proof” that the process works as written in the procedure manual?

20. Questions?

21. Wrap Up • Questions, concerns, comments – give us a call or email. • Kate Bowman – Admin Asst 855-3361 • http://www.indiana.edu/~iuaudit/ • Susan Fleener 855-5372; fleener@indiana.edu • We are available.