Process for execution of an audit includes the following key steps:

Preliminary Research and Planning

Preliminary research and planning is the initial stage of the audit process.  During this stage, internal auditor is required to seek a general understanding of the primary functions, services and activities of the department / unit / area being audited, and to solicit background and basic information and documents from the auditee for planning the audit.

Entry Meeting

Purposes of the entry / opening meeting are to establish communication between the auditor and the auditee that is crucial to the entire audit process and timely completion of an audit; to discuss the objectives, scope and risk areas of the audit; and to explain the process, requirement and formalities of the audit, etc.

Engagement

Based on the background information collected in the initial stage of the audit process and discussion at the entry meeting, a letter of engagement would be prepared for the auditee’s confirmation / signoff.  Purpose of the letter of engagement is to set out the audit objectives and scope, general requirements on which the audit would be performed, timing for the audit, and the auditor and auditee’s responsibilities, etc. (Note 1)

Field Work

Purpose of the field work and analysis is to gather audit evidence which forms the basis for evaluation of the audit area and expression of opinion at the conclusion of the audit.  Field work includes review of relevant policies, operating procedures, manuals, systems, records and documents necessary for the audit field work; interview with relevant staff; conduct physical inspection; perform system walkthrough; validation and testing of sampled transactions and examination of documents, files and data; and obtain representations of material facts regarding the audited operation from the management.

Exit Meeting

Upon completion of the audit field work, an exit / closing meeting would be conducted to discuss the audit observations / findings, risks and impact analysis and recommendations with the auditees, and to solicit their feedback and determine possible solutions to address the audit issues. President / Vice-President overseeing the auditee and / or the audit area may attend the exit / closing meeting as necessary.

Results Communication and Reporting

To communicate the results of the audit to the auditee, draft audit report would be compiled and issued to the auditee.  The auditee is expected to respond to the report within a reasonable period of time.  Management response returned would be incorporated in the report as appropriate.  The final audit report will be distributed to relevant stakeholders, including the Audit Committee and the President.  Progress / Interim report may be issued during the course of the audit as circumstances warrant. (Note 2)

To provide reasonable comfort to those charged with governance and to ensure the University Management’s viewpoints on the audit issues can get across to the Audit Committee, President / Vice-President overseeing the audit area and / or the auditee is invited to review the management response (including any improvement plan) and provide his comment on the management response before returning to IAO by the auditee for finalization of the audit report and submission to the Audit Committee.

Post Audit Follow-up

Purposes of the post audit follow-up are to determine whether audit issues identified at the conclusion of the audit have been addressed; associated risks have been mitigated adequately; and corrective actions / measures have been taken.  The post audit follow-up will be arranged within a reasonable period of time after the audit, depending primarily on the risk level of the audit issues.

Notes

1. Any request for change of the planned nature, objectives and scope of the audit and/or other engagement terms of the audit will be duly considered and assessed. For significant change request, the auditee’s upper management, the President, the Audit Committee and / or other relevant stakeholders will be duly consulted wherever appropriate.
2. Draft audit report will also be distributed to the auditee’s upper management to solicit its comment / response and/or further clarification on disputable audit issues, if any.