Audit Response Procedures

The basic response procedures for an internal audit report are outlined in University Policy No. 3004. The following notes the proper format in which the response should be written, in order to promote a standardized format that clearly communicates to all readers of the report agreement or disagreement with the issues identified, planned courses of action, responsibility for those courses of action and a timeline for completion.

Responses should be as concise and to the point as possible, and directly relate to the issues and recommendations identified in the report and planned corrective actions. Responses should be written and returned within the time period prescribed by policy.

For each issue identified in the report, and for which recommendations are made, the response should be in the following format:

If management agrees with the issue identified:

Issue: (Name of issue as noted in report)

Agree or Disagree: Agree

Planned Corrective Action: (Detail planned actions that will address each point of the recommendation)

Responsible Person: (Note name and title of individual responsible for implementing corrective action)

Planned Completion Date: (Note date in which corrective actions should be complete)

If management disagrees with an issue or recommendation based on their analysis of the situation, and no corrective action is planned:

Issue: (Name of issue as noted in report)

Agree or Disagree: Disagree

Reasons For Disagreement: (Detail reasons why management believes no corrective actions are needed)

Responsibility Statement For Non-Corrective Action : (State name and title of individual that accepts responsibility for accepting any risks that may be involved in deciding that no corrective action is necessary for this issue)

Follow-up

Audit follow-up will occur on or near the planned date for completing corrective actions. Our office will contact the department to request the status of actions taken or the status of planned actions. Audit testing will be performed as necessary to determine the extent to which the actions taken address the concerns of the audit point.

The follow-up process will note the status of the original audit report recommendations. Four status conditions are possible:

Complete - The original condition or issue noted in the audit no longer exists, or has been substantially reduced. This is obtained by either a) implementing the recommendation as outlined in the initial report or b) implementing an alternative solution that accomplishes the same goal.

Partially Complete - Corrective action is underway, but is not complete and a revised completion date is established.

Incomplete - No actions have been taken to remedy the condition noted in the audit and a revised completion date is established.

Incomplete, Risk Accepted By Management - The original condition still exists. Subject to the approval of the respective vice president, management accepts responsibility for not acting to substantially reduce the risk.