The Audit Process – Tufts Audit and Management Advisory Services (2024)

Step 1: Define Audit Objectives
Prior to the audit, AMAS conducts a preliminary planning and information gathering phase. The assigned auditor defines the audit objectives and likely scope of the audit. The auditor starts to develop the audit program to define the audit testing procedures. This step occurs after the audit has been assigned and where applicable, typically involves a review of the results from the last time an audit of the area occurred.

Step 2: Audit Announcement
Once the audit objectives have been defined, AMAS formally issues an audit engagement memo to the management of the area that will be audited. The memo’s distribution list may include senior administration officials that have responsibility for the university unit. The purpose of the memo is to introduce the objectives of the audit, to detail the planned review process, and to set the expectations for the course of the audit.

Step 3: Audit Entrance Meeting
AMAS initially meets with the auditee to discuss the audit scope and subsequent audit steps. At this meeting, the auditee should provide an overview of major programs and operations, relevant contact names, relevant policies and procedures, and other information that will assist us in the fieldwork. We will also discuss the expected length of the audit.

Step 4: Fieldwork
AMAS gathers information and performs audit testing in order to gain an understanding of internal controls; we examine documents and other records for evidence to determine whether effective internal controls are in place. During the audit fieldwork, we may also perform detailed testing of transactions; evaluate compliance with existing university policies and adherence to external regulations; and review system related controls for data integrity and completeness. The auditor will request additional information and documents as needed.

Risk Issue Levels: During the course of audit work performed, identified risks are rated within our work papers as High, Moderate or Low. This ensures consistency in reporting audit findings and to ensure the significance of each finding is rated per agreed upon criteria and level of concern. The risk level is recalculated over the course of the audit to reflect established internal controls that mitigate risk. The residual risk level helps AMAS determine whether the controls are adequate and if a recommendation is necessary to mitigate the risk further.

Step 5: Reviewing and Communicating Results
If AMAS identifies potential control weaknesses, policy or procedural violations, or other areas of concern during the course of the fieldwork, they are discussed with the auditee. Throughout the audit, the auditor will discuss any observations with management in order to ensure that any identified issue and associated risks are fully understood and to obtain agreement on proposed recommendations. The results of the audit, once confirmed, are communicated in the audit report.

Step 6: Audit Exit Meeting
At the conclusion of the fieldwork, AMAS formally meets with management to discuss our observations and audit recommendations that will be contained in the audit report. Recommendations are discussed and agreed upon by both parties to ensure that the management response is reasonable and achievable (and in most instances when the corrective action will occur).

Step 7: Audit Report
Management is expected to review audit issues and recommendations for completeness and accuracy and prepare a formal response and action plan.

AMAS issues the formal audit report which is used to inform senior university administrators and auditee management about any identified concerns and control weaknesses, and where and how these areas should be addressed. All audit reports are summarized in a separate report to the Trustee Audit, Risk and Compliance Committee.

Post Audit

Audit Survey
Following the issuance of the final audit report, the responsible management may be asked to complete a Post Audit Survey to help AMAS evaluate the effectiveness of the audit process, including audit planning and communications, auditor professionalism and performance, audit timing, and relevance of the report recommendations.

If you have been recently audited by our department and would like to provide feedback, please complete our online survey.

Follow-up Audits
If any significant audit findings were included in the final audit report, AMAS conducts a follow-up audit within six to twelve months after the original audit was completed . At that time, AMAS will request information concerning the status of agreed-to corrective actions by management.

Return to top