Overview of the Audit Process

1. Overview of the Audit Process Texas State Agency Internal Audit Forum July 27, 2009

2. Background This presentation is designed for executives and employees of Texas state agencies and institutions of higher education. This is a general overview of an audit process. The purpose is to provide information to help meet auditing, accountability, and transparency requirements of Americans Recovery and Reinvestment Act (ARRA).

3. Table of Contents • The Audit Process – What to Expect • Tips For a Smoother Audit • Receiving the Results and Writing Responses • Internal Control • Types of Compliance Requirements and Findings • What do Managers Need to Know? • Resources --

4. The Audit Process – What to Expect Most audits or monitoring visits follow this process although the order of the steps may vary: • Formal notification of the audit from the oversight agency. • Advance information request from auditor. • Risk assessment. • Entrance conference to discuss goals, objectives and timelines. • Planning and fieldwork in which auditors ask questions and perform testing. • Status reports during audit. • Exit conference where the draft report is reviewed and discussed. • Opportunity for management responses and corrective action plans. • Final report is issued. • Follow up to ensure that management’s corrective action occurred.

5. Audit Tips: Communication • Communicate expectations with the auditors. • Identify a single point of contact for data requests. • Establish a communication plan with your staff. • Request topics of discussion in advance so meetings are properly staffed. • Document all requests and responses. • Have the single point of contact communicate with auditors frequently.

6. Audit Tips: Communication • Use your internal auditor to help interpret “auditor speak.”* • Answer the question that is asked. Some of the questions may appear strange, such as those concerning about fraud, waste, and abuse; however, they are required by auditing standards and must be asked. • Explain any anomalies or questioned items.

7. Audit Tips: Documentation • Compile written information in advance of meetings. • Provide the source(s) and preparer(s) of the information. • Be responsive to the request. If you do not understand the question being asked or the information being requested, follow up. It is likely that it is just a difference in terminology.

8. Other Tips for a Smoother Audit • If key employees are scheduled to be on vacation or in training when a site visit is scheduled, be sure to have other staff available to answer questions. • Coordinate information technology needs, such as arranging Internet access or access to internal software programs.

9. Receiving Audit Results • Auditors should provide a list of issues or findings after every audit. • Management is typically given one to two weeks to provide a written response to the findings.

10. Writing Management Responses • If there is a finding, identify the root cause of the issue. • Document an action plan that includes the name and title of the person responsible for it and the timeframe for completion. • If you disagree with a finding, defend your position with facts and documentation.

11. Internal Control Internal control is an important part of an organization’s management plan that provides reasonable assurance of the accomplishment of goals and objectives, efficiency of operations, reliability of information, and compliance with laws and regulations. * Internal control is management’s responsibility.

12. Compliance Requirements • The federal audit guidance lists 14 types of compliance requirements. • A compliance audit supplement that contains special tests and provisions may be available for federal programs. • These tests and provisions are designed to audit the compliance requirements specific to the federal program.

13. 14 Types of Compliance Requirements • Activities Allowed or Unallowed • Allowable Costs/Cost Principles • Cash Management • Davis-Bacon Act • Eligibility • Equipment and Real Property Management • Matching, Level of Effort, Earmarking • Period of Availability of Federal Funds • Procurement, and Suspension and Debarment • Program Income • Real Property Acquisition Relocation Assistance • Reporting • Subrecipient Monitoring • Special Tests and Provisions (unique to each program)

14. Categories of Findings • * Material Weakness • * Material Non-Compliance • Significant Deficiency • Non-Compliance

15. What do Managers Need to Know? Executive management should: • Know about the existence of the compliance requirements . • Review prior findings at the agency . • Expect to be briefed on the resolution of findings, preferably quarterly. Program managers should : • Be fully aware of the compliance requirements . • Provide documentation showing program compliance. • Discuss the progress and ongoing resolution of issues and the actions taken.

16. Resources GAO’s Follow the Money http://www.gao.gov/recovery/ Recovery http://www.recovery.gov/

17. Resources Texas Comptroller of Public Accounts Fiscal Management for ARRA reporting https://fmx.cpa.state.tx.us/fmx/recovery/index.php Texas Recovery website http://www.cpa.state.tx.us/recovery/

18. Resources COSO Internal Controls Guidance on Monitoring Internal Control Systems http://www.coso.org/documents/COSO_Guidance_On_Monitoring_Intro_online1.pdf Internal Control – Integrated Framework http://www.coso.org/IC-IntegratedFramework-summary.htm (Introductions available online. Books available for purchase.)

19. Resources GAO Audit References Yellow Book – Government Auditing Standards http://www.gao.gov/govaud/ybk01.htm Green Book – Standards for Internal Control in the Federal Government http://www.gao.gov/products/AIMD-00-21.3.1 Internal Control Management and Evaluation Tool http://www.gao.gov/new.items/d011008g.pdf

20. Resources Office of Management and Budget (OMB) Guidance OMB Circular A-133 Compliance Supplement http://www.whitehouse.gov/omb/circulars_a133_compliance_09toc/ OMB Circular A-123 Management’s Responsibility for Internal Controls http://www.whitehouse.gov/omb/assets/omb/circulars/a123/a123_rev.pdf OMB Section 1512 Reporting Webinars (July 20-23, 2009) http://www.whitehouse.gov/Recovery/WebinarTrainingMaterials/

21. Resources This information is provided by a subcommittee of the Texas State Agency Internal Audit Forum (SAIAF). It will be updated periodically. http://www.dir.texas.gov/sacc/internalaudit/index.htm http://www.dir.state.tx.us/sacc/internalaudit/sacc_stateagency_internauditforum-saiaf_arra_traning.htm

22. Questions Please address questions about the information in this presentation to your Internal Audit Director.