ASU Internal Audit Protocol

Download the PDF Version

The protocol described below is designed to clarify the audit process for audits conducted by ASU University Audit and Advisory Services (University Audit) according to its annual audit plan, as well as ad
hoc audits performed upon special request. (Note: This protocol does not apply to audits performed for ASU's Institutional Athletics Compliance Team.) Questions regarding this protocol should be directed to the Director of University Audit and Advisory Services (480.965.5511).

Annual Audit Plan and Basis for Program Selection:
University Audit will perform financial and compliance audits according to an annual audit plan approved by the Senior Vice President and General Counsel, in consultation with the President and other senior university officers. Audit areas included in the plan will usually be those with the highest combined assessed risk as determined by a formal risk assessment performed by University Audit.

University Audit will also perform ad hoc, special purpose audits and reviews in response to requests from University management. All requests for ad hoc, special purpose audits or reviews will be initiated at the vice president/provost level. The vice president/provost of the area requesting the audit or review submits the request to the Vice President and General Counsel. The request is forwarded to the University’s Executive Committee for determination as to whether the request should be forwarded to University Audit.

Introductory Memorandum:

For financial and compliance audits performed according to University Audit’s annual audit plan, an introductory memorandum from the Director of University Audit will be sent to the vice president/provost or designee responsible for the program being audited two to three weeks before the start of the audit (other University Officers identified in Column A of Attachment 1, Schedule of Audit Participants will be copied on the introductory memorandum). For ad hoc reviews, the need for an introductory memorandum will be decided jointly with the responsible vice president/provost. The introductory memorandum should:

• Identify the area/unit to be audited;
• Identify the preliminary audit objectives;
• Identify the report format (i.e., written report, informal memorandum, or oral report); and,
• Inform the recipient that an entrance conference will be scheduled.

Entrance Conference:
An entrance conference will be scheduled one to two weeks before the audit begins. Participants should include the University Officers identified in Column B of Attachment 1, Schedule of Audit Participants. The Dean/University Officer may include other participants as he or she deems appropriate.

The purpose of the entrance conference is to:

• Introduce the University Audit staff members performing the audit;
• Identify the program contact person with whom University Audit will work with in performing the audit;
• Discuss the preliminary audit objectives and determine if there are any areas of concern that should be addressed during the audit; and,
• Review the final reporting process.

Draft Report:
A final written report will be issued for all financial and compliance audits conducted in accordance with University Audit's annual audit plan. For ad hoc, special purpose audits, University Audit will issue either a written report, an informal memorandum, or an oral report as considered appropriate after consultation with the appropriate officials of the area requesting the ad hoc audit. In the case of a written report or memorandum, a draft will be provided to the University Officers identified in Column C of Attachment 1, Schedule of Audit Participants.

Responses to Recommendations:
Responses to recommendations will be prepared by the director of the program being audited, approved by the university officer to whom the director reports, and submitted to University Audit.

In general, responses should state whether or not the findings and recommendations are agreed with, be specific as to what changes will be implemented, and provide target completion dates for implementation of the changes. University Audit is available to provide departments with advice on responses.

Final Draft Report:
University Audit will prepare a final draft report, which will include the responses from the responsible officials. The final draft report will serve as the basis for the discussion at the exit conference.

Exit Conference:
An exit conference will be held with the university officers, or designees, identified in Column E of Attachment 1, Schedule of Audit Participants for the purpose of reviewing the draft report and management responses to:

• Confirm the correctness of the factual data presented;
• Determine if all pertinent information has been considered;
• Answer questions about the recommendations and findings;
• Discuss revisions/changes proposed by the Dean or University Officer; and,
• Discuss the audit responses and timing of implementation for accepted recommendations.

Final Report Distribution:
After the exit conference, departmental responses and agreed upon revisions will be added to the report before final distribution. For audits performed according to University Audit's annual audit plan, the university officers identified in Column F of Attachment 1, Schedule of Audit Participants will receive the final report. For ad hoc, special purpose audits, the report distribution will be decided jointly with the Provost/Vice President responsible for the audit area.