RESPONSE PROCEDURES FOR AN INTERNAL AUDIT REPORT
The basic response procedures for an internal audit report are outlined in University Policy No. 3004. The following notes the proper format in which the response should be written, in order to promote a standardized format that clearly communicates to all readers of the report agreement or disagreement with the issues identified, planned courses of action, responsibility for those courses of action and a timeline for completion.
Responses should be as concise and to the point as possible, and directly relate to the issues and recommendations identified in the report and planned corrective actions. Responses should be written and returned within the time period prescribed by policy.
For each issue identified in the report, and for which recommendations are made, the response should be in the following format:
If management agrees with the issue identified:
Issue: (Name of issue as noted in report)
Agree or Disagree: Agree
Planned Corrective Action: (Detail planned actions that will address each point of the recommendation)
Responsible Person: (Note name and title of individual responsible for implementing corrective action)
Planned Completion Date: (Note date in which corrective actions should be complete)
If management disagrees with an issue or recommendation based on their analysis of the situation, and no corrective action is planned:
Issue: (Name of issue as noted in report)
Agree or Disagree: Disagree
Reasons For Disagreement: (Detail reasons why management believes no corrective actions are needed)
Responsibility Statement For Non-Corrective Action : (State name and title of individual that accepts responsibility for accepting any risks that may be involved in deciding that no corrective action is necessary for this issue)
Follow-up Reports
Within approximately one year, a follow-up of audit findings is made. The department head is requested to detail actions taken or the status of planned actions. Audit testing will be performed as necessary to verify actions taken in connection with the audit findings.
The follow-up review will note the status of the original audit report recommendations. Four status conditions are possible:
Complete - The original condition or issue noted in the audit no longer exists, or has been substantially reduced. This is obtained by either a) implementing the recommendation as outlined in the initial report or b) implementing an alternative solution that accomplished the same goal.
Partially Complete - remedial action is underway, but has not yet been completed.
Incomplete - No actions have been taken to remedy the condition noted in the audit.
Incomplete, Risk Accepted By Management - Original condition still exists, and Management accepts responsibility for any risk of not implementing remedial action.
