An audit, whether conducted by an internal or external auditor, will typically consist of the following steps. The term "client" usually means the management of the department or activity being audited.
The auditor will gather and review background information about the client's activity, determine the audit scope and objectives, and develop an audit program identifying the issues to be examined, questions to be asked, and documents to be reviewed.
The auditor meets with department management to discuss the audit objectives, approximate time schedules, types of auditing tests, and how the audit results will be communicated.
The auditor visits the campus department to interview key personnel and evaluate whether good internal control processes are in place, documented, and being followed. This will usually include transaction testing to verify that established policies and procedures are actually being followed.
Analysis - Determination of Results
As deficiencies or "opportunities for improvement" are identified, the auditor will bring them to the client's attention in an attempt to resolve them before completing the fieldwork. At the end of the fieldwork, the auditor usually reviews all preliminary observations and findings with the client at an informal exit conference.
Draft Report - Exit Conference
The auditor writes a draft audit report, identifying problems detected and making recommendations for improving operations, and forwards the report to the client for review. The auditor meets with the client at a formal exit conference to discuss the draft audit report and resolve any disagreements.
The auditor issues a final draft report, and asks the client to submit a written response to each recommendation, usually within 30 - 45 days. The client is expected to concur with each recommendation and provide a corrective action plan including an estimated date of completion.
The auditor issues the final audit report.
Generally, the auditor will follow up to ensure implementation of the recommendations.