Audit Process

Internal Audit Process

During the course of the year, IA works from the Audit Plan to complete individual projects. While each project is unique, the core process followed by IA is the same. The process is outlined below and discussed at the entrance meeting:


Internal Audit will notify the appropriate department personnel of the upcoming audit and its purpose and will request for an entrance meeting.


During the planning process, the auditor gains an understanding of the area to be audited. This includes interviewing key personnel, reviewing relevant policies and procedures and, if available, reviewing prior audit work papers. A risk assessment matrix is created documenting key risk areas, the controls implemented to mitigate the risk, the probability and impact of the risk and the planned audit steps.

Entrance Meeting

The entrance meeting should include senior management and any administrative staff that may be involved in the audit. During this meeting, the scope of the audit will be discussed. You should feel free to ask the auditor to review areas that you are concerned about. The time frame of the audit will be determined, and you should discuss any potential timing issues (e.g. vacations, deadlines) that could impact the audit. It doesn't take as much of your time as you might expect!


During the audit fieldwork, the auditor will test the adequacy and effectiveness of the internal control environment for the specific audited area. The nature of the work includes interviews, sample selection, sample testing against the criteria and documentation of the results.


Throughout the process, the auditor will keep you informed, and you will have an opportunity to discuss issues noted and the possible solutions.

Draft Audit Report

After the fieldwork is completed, the auditor will draft a report. The report consists of several sections and includes: the distribution list, the follow-up date, a general overview of your unit, the scope of the audit, any major audit concerns, the overall conclusion, and detailed commentary describing the findings and recommended solutions. You should read the draft report carefully to make sure there are no errors. If you find a mistake, inform the auditor right away so that it can be corrected before the final report is issued.

Management Response

Management prepares a response detailing their corrective action plan, including estimated completion dates.

Exit Meeting

An exit meeting will be held so that everyone can discuss the audit report and review your management responses. This is an opportunity to discuss how the audit went and any remaining issues.

Final Audit Report

A final report is issued integrating management's responses. The report is distributed to the responsible management and other senior business officials.


Follow-up reviews are performed on an issue-by-issue basis and typically occur shortly after the expected completion date, so that agreed-upon corrective actions can be implemented. The purpose of the follow-up is to verify that you have implemented the agreed-upon corrective actions.