Office of the Inspector General - Audit Process

Audit Team

Usually, a team of auditors headed by a lead auditor as the point of contact for an engagement performs the work. However, depending on the size, scope and complexity of the work, only one auditor may be assigned to the engagement.

Audit Engagement Letter

The Assistant Inspector General for Audit notifies responsible management with an engagement letter between 7 and 14 days before an entrance conference is held or audit fieldwork begins. The engagement letter presents: (1) the objectives of the audit; (2) the reason for the audit (Annual Risk-Based Audit Plan, Commissioners, etc.); (3) the estimated start date; (4) the location of the fieldwork; (5) any special resources needed by the audit team such as working space; (6) the name and telephone number of the primary contact from the Office of the Inspector General; and (7) a statement that the contact will arrange for an entrance conference. Typically, an engagement letter may not be provided for follow-up reviews, special reviews, or audits that require the auditor's presence not to be known in advance.

Entrance Conference

This is a conference with responsible management (and provider's staff) and staff members for introduction of the audit team and to discuss: (1) the purpose, scope and principal features of the audit; (2) estimated time to complete the audit; (3) arrangements for space and access to records; (4) the management contact during the audit; and (5) any management request for audit coverage in other areas, or other concerns of management. The Assistant Inspector General for Audit or designee must be present at every entrance conference.

Preliminary Survey

This work consists of gathering background information on the operations of the entity being audited, and the related laws, rules, regulations, and policies and procedures that govern the activity. Preliminary survey procedures that need to be performed on-site may be conducted before fieldwork begins, or delayed until after fieldwork begins depending on budget constraints and the relative importance of the procedures to gaining an adequate understanding of the activity being audited.

Audit Program

An audit program is a document which lists the audit procedures to be followed during an audit. The audit program also states the objectives of the audit. Audit programs will be developed for each audit based on the results of the preliminary survey and any additional information provided before or during the entrance conference. All audit programs must be approved by Office of the Inspector General management before fieldwork begins.

Fieldwork

Fieldwork is the work performed on-site to gather audit evidence to achieve the audit objectives. Audit procedures during fieldwork may include the review and test of records, interviews with management and staff, and the application of various analytical procedures. Throughout fieldwork, the lead auditor will keep management informed, and management will have opportunities to discuss observations/issues noted.

Audit Management Review

The Assistant Inspector General for Audit and/or designee, to ensure compliance with professional auditing standards, reviews the work performed by the audit team and prepare reviews notes for the auditors to clear. The review notes may request additional information and work to be performed.

Exit Conference

This is a conference with responsible management at the completion of the audit to communicate findings and recommendations developed during the audit. Also, this is an opportunity to receive management's views and seek or present clarification on the identified audit findings and recommendations.

OIG Reports

OIG reports are first provided to responsible management as Discussion Drafts for review and response and in final Audit Report form after responses have been received. The responsible management has at least 10 business days (approximately 2 weeks) after receipt of the draft report to respond and provide action plans to the audit findings and recommendations. Responsible management's responses and action plans with anticipated implementation due dates and OIG's audit evaluation of management's responses are included in the final audit report. However, prior to the final issuance of the audit report, the General Manager and/or designee is given 10 business days (approximately 2 weeks) to review his/her staff’s responses to OIG's audit findings and recommendations to determine whether the responses are sufficient. If the General Manager and/or designee determines the responses are insufficient for any reason, then he/she can have his/her staff modify the responses accordingly. Also note,  OIG Audit will not modify the audit findings and recommendations after the exit conference because they are based on facts agreed upon by management. Final audit reports are issued to the Commissioners, the General Manager, and the Team/Office responsible management.

Audit Memos

While conducting audit fieldwork, auditors will occasionally encounter findings that are directly or indirectly the result of activity or inactivity of another department(s) not currently within the scope of the audit and/or may be classified as low risk to the Commission. In these instances, a separate Audit Memo will be issued to the responsible department head to coincide with the issuance of the Audit Report. Background information about the audit and specifics about the audit finding(s) will be disclosed in the memorandum, but not the entire Audit Report. The responsible department head is expected to respond to the related audit recommendation(s) within a specified period of time and provide a plan of action (where applicable). The Audit Memo will not be distributed to the Commissioners; however, if the implementation of management’s action plan to mitigate the risk associated with the findings in the Audit Memo is more than a year delinquent, then the Assistant Inspector General for Audit will escalate the matter to the Commissioners.

Follow-up Reviews

It is the policy of the Office of the Inspector General to conduct follow-up reviews of audits performed by the department. The purpose of these audits is to determine the status of actions agreed to by management in order to respond to OIG audit recommendations and correct deficiencies noted in the audit. 

Any requests for extensions beyond the maximum limit of two (2) will be escalated to the Inspector General.