审计过程

每年, 内部审计在进行全校范围的初步风险评估后，准备一份滚动三年审计计划. 审计计划的目的是概述内部审计将在整个财政年度进行的审计.

Although every audit is unique, the audit process is generally similar for most engagements. The information outlined below is intended to provide an overview of the audit process.

大多数领域(特殊要求除外)的审计是根据年度综合风险评估. This assessment includes input from management and staff in identifying risks.

增加部门被审计机会的另一个因素是全年未返回内部审计要求的信息.e., risk assessment questionnaires, revenue analysis information, 等.). If the information needed to rank an areas’ risk is not received, 然后很可能对这些区域进行审计，以收集必要的信息.

在规划, we will review any prior audits of the unit, research applicable state/federal laws and regulations. 通知将发送给部门主管，安排入学会议，有时会要求初始文件(政策), 程序, 评估, 等.) for key areas being reviewed. 内部审计 will prepare an audit program. 我们还与关键人员进行初步讨论，以了解流程并识别风险和控制. 在某些情况下，根据审计的性质，将不安排入场会议.

我们将通知部门主管即将进行的审计，并提交一份索取资料的请求. We typically notify the department head at least two weeks in advance. The information request and questionnaire are typically due back to us within two weeks. Although audit notifications are a common courtesy, 在某些情况下，内部审计办公室可能不需要事先通知.

At the beginning of an audit, a meeting is held with the department head of the area being audited and the auditors. 被审计单位的负责人可以自行决定邀请其他管理人员出席. 在这次会议中，我们讨论审查的范围、目标和时间安排(如果此时知道的话)。. 如果最初的要求之前没有包含在审计通知中，审计师可以要求提供信息. There may be times when certain planned audit 程序 may be discussed. The auditor will also answer any questions that management may have concerning the audit.

我们会与不同部门的员工面谈，了解他们与检讨范畴有关的职责. The purpose of these meetings is for us to learn your departmental processes and 程序. These meetings will typically be held in the department being audited.

The audit program list 程序 that will be performed during the course of the audit. 有时会根据入学会议期间获得的信息对审核程序进行调整. This work will be performed in our office; however, 在审核过程中，也有可能对审核程序进行额外的修改.

在野外工作, 审计组将确定该单位业务内部控制的充分性和效率. 审计小组还将纳入最佳/良好实践，以评估流程是否有效运行，并确定是否符合联邦和州法规以及大学政策和程序. Additional information will be gathered through follow-up interviews, 观察过程, 确认, 分析数据, and performing tests of controls (including testing technology controls). With the exception of first-time audits, when considerable audit testing is necessary, 当内部控制被认为是强有力的时，测试的范围和程度可能会大大减少. 审计小组将尽量安排现场实地考察的时间，以尽量减少对被审计单位日常运作的干扰.

The auditor will document any observations during his/her fieldwork. 实地考察期间, 审核员可以与管理层讨论观察结果，或定期向管理层提供最新进展.

An audit finding is defined as an area of potential control weakness, risk associated with a policy violation, inadequate performance, financial misstatement, or other problematic issue identified during the audit. 在审计过程中发现一个或多个缺陷并不罕见. Most will be relatively minor issues that will require a slight adjustment to a process. Identified control weaknesses, 不服从, 或将违规行为记录为可能列入报告草稿的潜在问题，并在将其列入报告之前与管理部门进行讨论. 确定问题的重要性是一种专业判断，并须在报告阶段接受内部审计管理层的审查. 内部审计 staff are always available to assist departments in any way.

Once the fieldwork is completed, we will draft an audit report. The report contains the objective, 范围, and results of the engagement and, 最有可能的, has recommendations for management to consider. 报告内容与管理层进行多次讨论，直到管理层找到观察结果的最佳解决方案. 管理层将有机会在退出会议期间对内容发表评论并讨论任何问题. 本报告中将有一个地方，供各部门在最终审计报告中作出回应.

At the conclusion of the audit, 与部门主管举行会议，提交审计报告草稿，并详细讨论审计结果和建议. 在这一点上，部门主管将有机会提出问题并表达关切. This meeting will typically be held with the department being audited; however, 被审计单位的负责人可以自行决定邀请其他管理人员出席.

Once the department head receives the draft audit report, 他/她将被要求在十(10)个工作日内就每个发现提供部门回应和行动计划. 行动计划的目的是让管理层具体说明如何解决问题. 行动计划应在退出会议后两周内提交，并将逐字逐句地列入最终审计报告. 管理部门还将被要求提出一个预期的目标日期，在该日期内将执行行动计划. 对审计报告的适当回应是执行审计报告中提出的审计建议, 实施替代程序，提供与审计师推荐程序大致相同程度的控制, 或者一份声明，说明管理层已经承担了没有对报告的发现采取纠正措施的风险. If the department does not respond within the appropriate timeframe, 将发表最后审计报告，指出所审查的领域尚未作出答复.

The final report will be distributed to the President, 副总统, 高级管理人员, the Chief Audit Executive at the Mississippi Institutions of Higher Learning, and other personnel relevant to each audit.