Internal Audit Function and Process
About the Internal Audit Function
The SIU Office of Internal Audit has developed its own procedures to ensure that scheduled audits are conducted as efficiently as possible. By applying an agile approach, we strive to work collaboratively with departments to assess risk, evaluate internal controls, and support effective, compliant, and efficient operations. Our positioning within the University allows us to serve both campus departments and the Board by providing valuable insight into key areas of university operations.
The Audit Process
SIU Internal Audit follows a structured and consistent audit process to guide all engagements, thereby ensuring clarity, compliance, and effective communication at every step. Our goal is not to catch mistakes but to collaboratively identify risks, recommend improvements, and promote best practices that enhance university operations and ultimately benefit our students. Successful audits are built on a shared understanding of the objectives, expectations, terminology, and timelines involved. Throughout the audit process, these aspects are clearly outlined and discussed to maintain transparency and alignment between all parties.
The following are the steps of the standard audit process:
Pre-Fieldwork
Every audit will include pre-fieldwork to gather information on the topic being audited. During this phase, the internal audit personnel will generally schedule an entrance conference to meet with management to discuss basic information regarding the audit topic or department, determine timing and appropriate contacts, and answer management questions. The auditor(s) assigned will then proceed with the development of the Audit Program, which details the engagement steps to be performed. This may vary in form and content depending upon the nature of the engagement, but will generally include testing procedures to be performed during the fieldwork phase.
Fieldwork
Assigned auditor(s) will perform audit program steps, including, but not limited to, gaining an understanding of departmental procedures by reviewing internal controls, making general observations, conducting interviews and inquiries, and performing testing procedures, which can include: sample testing, documentation testing, and system testing.
Reporting
At the completion of each audit, a written report is issued to the appropriate departmental contacts. Reports go through a drafting and finalization process, providing the opportunity for auditee review, update, and response.
- Draft Report is the first draft and includes the preliminary results of audit fieldwork. This draft is sent to operational contacts, providing an opportunity for the department or management to provide additional information, documentation, or clarification regarding the audit observations that may support changes to the report.
- Preliminary Draft Report for Management Response is the updated report, which includes any changes made as a result of information, documentation, or clarification received after the draft report was issued, and includes a request for management responses for the recommendations included in the report.
- Final Report is the final version of the report and will be issued to the full distribution indicated in the report, including, but not limited to, the appropriate Vice Chancellor, Chancellor, General Counsel, Chief Compliance Officer, and the SIU President.
Follow-up
Assigned auditor(s) will perform an audit follow-up on recommendations that remain unresolved after the issuance of the final report. Management is required to provide a response regarding the current status of the issues that have been previously noted. If issues are not resolved, Internal Audit will continue to follow up on issues that remain open until appropriate actions have been taken. Audit follow-up will conclude upon resolution of the last remaining open audit issue; at at which time follow-up communication will take place, and a final memo will be distributed. All open recommendations are tracked within our audit software and are reported to the Board on a quarterly basis. In cases where additional follow-up cycles occur and corrective actions have not been taken, a memo may be sent to the Chancellor to provide notification of the lapsed deadline.
