Audit Process

The audit process involves several steps, detailed below.

Internal Audit notifies the University in writing when an area is selected for audit. An engagement letter is sent to UMBC describing the general objectives of the audit. Always notify MAS if you receive an engagement letter.

The Internal Auditor in charge schedules a meeting with MAS, the department, and appropriate personnel to discuss the objective of the audit, scope, audit process, timeline, and information the client may need to supply. Departments are encouraged to present any questions or concerns they have about the audit process. Departments may also request specific functions be examined in the audit.

The Internal Auditor gains an understanding of the department’s operation or area being reviewed. The Internal Auditor may request written policies and procedures, organizational charts, job descriptions, and other information in order to become familiar with the department’s operation. Internal controls may be reviewed and documented.

During the Fieldwork phase, the Internal Auditor reviews, tests and evaluates internal controls to determine if they are operating effectively and assess risk management.

During the audit, the Internal Auditor will attempt to keep the department informed of findings and/or concerns.   This communication serves two purposes:

  1. It provides the department an opportunity to clarify the Internal Auditor’s understanding of the facts and circumstances surrounding the findings and to correct misunderstandings and inaccuracies;
  2. and to provide the department with notice of areas where improvements may be needed so they can take corrective action as soon as possible.
The Draft Report includes background of the area being audited, comments, and recommendations. The department and appropriate parties are able to review the Draft Report and offer feedback before the Exit Conference.

Internal Auditor, department representatives, and MAS meet to discuss the Draft Audit Report and clarify any ambiguities or questions.

Working through MAS, department responds, in writing, to each audit finding and recommendation. In the response, MAS will assist the department in explaining how report finding/recommendations will be resolved and include an implementation timetable.

After receipt of the Management Responses by the Internal Auditor, a Final Audit Report is prepared. The Final Audit Report contains Background, Comments, Recommendations, and Management Responses. It is distributed to senior level management and appropriate parties.

If there are audit findings in need of correction, a follow-up audit will be conducted roughly 6-months after the initial audit. The follow-up may be the examination of corrective actions or a subsequent audit. The nature of the follow-up depends on the seriousness and complexity of the deficiencies found in the original audit. Once the corrective action has been implemented, the audit findings will be closed. The follow-up can be conducted by an Internal Auditor and/or MAS.