Follow-up Auditing

An audit is officially closed after all of the recommendations have been recommended for closure through the follow-up audit process. The final audit report that is distributed to the Board of Regents Audit and Finance Committee includes the formal management response which consists of the plan of action and implementation deadline for each recommendation in the report. We will use the implementation deadline to determine when follow-up procedures should be conducted. Sometimes we need to wait for an appropriate duration of time beyond the implementation deadline in order to have enough data on which to perform follow-up procedures. See below for the most frequently asked questions in regards to follow-up auditing.

Internal audit standards require that a follow-up process is implemented to monitor the disposition of audit results and ensure that action plans have been effectively implemented. Our professional goal is to conduct follow-up auditing in a timely manner and report on the results.

There are two primary objectives for follow-up auditing:

  1. Was the recommendation implemented as described in the plan of action submitted in the formal management response?
  2. Did the recommendation and plan of action result in the intended effect of mitigating the risk that had necessitated the recommendation in the first place (in other words, is the recommendation operating as intended?)

Each fiscal year we schedule follow-up auditing for recommendations that have follow-up due based on their implementation deadline. We will:

  1. Contact the respective university audit liaison to notify them regarding which prior audits have recommendations on which follow-up will occur and the approximate timing of our follow-up activities.
  2. As follow-up activities progress, each process owner or department head and university audit liaison is notified as relevant to the recommendations and plans of action. Along with notification the auditor usually requests information such as:
    1. A written update on the status of implementation of the recommendation.
    2. Documentation that validates the recommendation was implemented.

We can often accomplish our follow-up audit procedures via telephone and email communications, but we value in person meetings when they can be arranged. We take your time into consideration, so please let us know what will work best for you.

Results of follow-up auditing are reported to the university audit liaison and leadership in the reporting line relevant to the audit. They are also presented to the Board of Regents Audit and Finance Committee at their regularly scheduled meetings. The Audit and Finance Committee usually meets in February, May, September, and November. This process provides assurance to university leadership and the Audit and Finance Committee that recommendations receive an appropriate level of attention by management and are implemented in a timely manner.

On occasion we conduct follow-up activities and discover staffing or process changes resulted in a recommendation that was not implemented. In this situation, we report that we followed-up with the department but that circumstances prevented us from recommending closure and that follow-up audit activities will be rescheduled for another date in the future.  

Too many instances of this can reflect negatively upon the department unless reasonable explanations are provided, usually resulting from extenuating circumstances that are not likely to be repeated.

If you are leading a department or have responsibility for a function or process that was audited, you will receive a copy of the final audit report that describes the audit results, formal plans of action, and implementation deadlines. If you’re unsure as to which recommendations remain in an open status, thus eligible for follow-up auditing activities, please contact us.