City Manager's Office

 What to Expect From an Audit?

IA understands that the prospect of an audit can sometimes be unsettling to City departments. But the audit process doesn't have to be confusing. IA strives to make its audit process as transparent and understandable as possible. Below you will find a general description of how an audit is conducted.

Audit Steps

A typical audit goes through the stages described below. The amount of time needed for each step depends on the scope of the audit, the type of testing or reviews that need to be done, and the ease or difficulty of retrieving information. Your auditor should provide you with a tentative timetable for the audit and keep you apprised of where he or she is during the process.

1. Audit Selection--Audits are identifies as a result of the bi-annual risk assessment and placed on the workplan approved by the Audit Committee. Audits can also be conducted on an ad hoc basis as requested by departments, the City Manager, or Council.
2. Background Survey--The auditors familiarize themselves with the department or function being audited. They review similar audits in other cities, identify significant risks or potential problems, and find best practices or benchmarks to gauge performance. The auditors also inform the auditee about the planned audit and set up the audit entrance conference.
3. Tentative Audit Plan--The auditors develop a preliminary plan for the audit, including its objectives, scope, methodology, and suggested work steps.
4. Entrance Conference--The auditors and audit manager meet with the auditee prior to starting fieldwork. The purpose of the conference is to review the scope of the proposed work, to identify areas of concern, and to establish a constructive working relationship. The auditors will review the audit plan to explain and clarify the scope of the audit. The auditee is encouraged to comment on the scope and objectives as well as to suggest additional areas for evaluation.
5. Fieldwork--The auditors conduct the audit at the auditee's workplace.  The auditors will typically interview staff members and asked that key processes are explained. The auditors will also carry out tests that were created in the audit plan to provide reasonable assurance that internal controls are functioning properly. All fieldwork is documented in electronic workpapers that become the basis for the conclusions reached in the audit.
6. Report Writing--The core of the report will be the auditor's findings, which are problem areas or opportunities to improve performance. Each finding has recommendation(s) for action to correct the problem or improve operations.
7. Exit Conference--The auditee will receive a draft of the report prior to an exit conference. The exit conference is a final meeting with the auditee to confirm the factual accuracy and fairness of the report draft and address any related concerns that department management may have. If necessary, the report draft will be updated to reflect information shared at the exit conference and a new draft will be sent to the department.
8. Department Response--Once the draft report is finalized, the auditee has two weeks to draft a response. Departments may respond that agree or disagree with each recommendation. If the department agrees, it is encouraged to identify who will implement the recommendation(s) and when it will be carried out.  If the department disagrees, it should propose an alternative solution to the problem identified.
9. Report Release--The department's response is included in the final report, which is then submitted to auditee management, the Audit Committee, City Manager, City Council, and posted on the IA website.
10. Audit Follow-Up--Follow-up audits may be conducted by Internal Audit 6-12 months after the final report date and any audit exceptions will be reported to department management and the City Manager for further resolution.