Indiana University Internal Audit

Internal Audit is a central administrative unit of the University with offices located on the Bloomington and Indianapolis campuses. Internal Audit reports operationally to the Vice President for Administration with dotted line representation to the Indiana University Board of Trustees. Internal Audit's coverage and service extends to all IU campuses (except IPFW at Fort Wayne, which is administered by Purdue). Internal Audit is also a control which functions by examining and evaluating the adequacy and effectiveness of other controls throughout the University for administrators, the Board of Trustees, and external auditors. Finally, Internal Audit provides assistance to the University's external auditors in their performance of the annual audits of the University financial statements and A133-Federal Awards, as well as, to assist other state, federal, and public auditors.

Charter

INTRODUCTION

Indiana University supports Internal Audit as an independent appraisal function to examine and evaluate University activities as a service to management and the Board of Trustees. The mission of Internal Audit is to support members of the University in the effective discharge of their responsibilities. To this end, Internal Audit will furnish them with analyses, recommendations, counsel, and information concerning the activities examined.

ORGANIZATION AND BOARD REPORTING

The Internal Audit Director will report to the Vice President for Administration with dotted line reporting to the Finance and Audit Committee of the Board of Trustees. The committee will have final approval of the hiring, firing, and salary changes for the Director.

Annually, the Director will submit to the Board a written report on the internal audit activity during the preceding fiscal year. The Director shall also make an oral report to the Finance and Audit Committee. Immediately following the oral report, the Director shall confer with the committee, outside the presence of University officials, on any subject germane to Internal Audit's area of responsibility.

The Internal Audit Director will make a written report to the Chair of the Finance and Audit Committee whenever there is evidence of defalcations or other problems exceeding $25,000. In addition, if the circumstances ever warrant such action, the Internal Audit Director may circumvent normal University reporting lines and communicate directly with the Chair of the Finance and Audit Committee.

AUTHORIZATION AND RESPONSIBILITIES

Internal Audit has the authority to audit all parts of the University and shall have full and complete access to any of the organization's records, physical properties, and personnel relevant to the performance of an audit. Documents and information given to internal auditors during a periodic review will be handled in the same prudent manner as by those employees normally accountable for them.

Internal Audit will have no direct responsibility or authority for any of the activities or operations they review. They should not develop and install procedures, prepare records, or engage in activities that would normally be reviewed by internal auditors. Furthermore, an internal audit does not in any way relieve other persons in the University of the responsibilities assigned to them.

REPORTING RESPONSIBILITIES

A written report will be prepared and issued by the Internal Audit Director following the conclusion of each audit. Copies of the report will be distributed as appropriate. The manager of the activity or department receiving the report will respond within thirty days and forward a copy of the response to those included on the distribution list. The response will indicate what actions were taken regarding specific report findings and recommendations.

The manager receiving the report is responsible for ensuring that progress is made toward correcting any unsatisfactory conditions. Internal Audit is responsible for determining whether the action taken is adequate to resolve audit findings. If the action is not adequate, Internal Audit will inform University management of the potential risk and exposure in allowing the unsatisfactory conditions to continue.

MISSION OBJECTIVE

Internal Audit's objectives in accomplishing its mission will include the following:

Determine the accuracy and propriety of financial transactions
Evaluate financial and operational procedures for adequacy of internal controls and provide advice and guidance on control aspects of new policies, systems, processes, and procedures
Verify the existence of University assets and ensure that proper safeguards are maintained to protect them from loss
Determine the level of compliance with University policies and procedures, and state and federal laws and regulations
Evaluate the accuracy, effectiveness, and efficiency of the University's electronic information and processing systems
Determine the effectiveness and efficiency of organizations in accomplishing their mission and identify operational opportunities for cost savings and revenue enhancements
Coordinate audit efforts with, and provide assistance to, the Indiana State Board of Accounts and other external auditors
Investigate fiscal misconduct

Back to the top

STANDARDS AND ETHICS

In all of its activities, Internal Audit will adhere to the Standards for the Professional Practice of Internal Auditing and the Code of Ethics adopted by the Institute of Internal Auditors.

Mission Statement(s)/Objectives/Values

MISSION STATEMENT

(short form)

To provide the University
with an independent appraisal
of it's financial, operational,
and control activities.

MISSION STATEMENT

(long form)

Internal Audit exists to support administration and the Board of Trustees in the effective discharge of their responsibilities. Using our knowledge and professional judgement, we will provide an independent appraisal of the University's financial, operational, and control activities. We will report on the adequacy of internal controls, the accuracy and propriety of transactions, the extent to which assets are accounted for and safeguarded, and the level of compliance with institutional policies and government laws and regulations. Additionally, we will provide analyses, recommendations, counsel, and information concerning the activities reviewed.

OUR OBJECTIVES IN ACCOMPLISHING OUR MISSION INCLUDE THE FOLLOWING:

Determine the accuracy and propriety of financial transactions
Evaluate financial and operational procedures for adequacy of internal controls and provide advice and guidance on control aspects of new policies, systems, processes, and procedures
Verify the existence of University assets and ensure that proper safeguards are maintained to protect them from loss
Determine the level of compliance with University policies and procedures, state and federal laws and government regulations
Evaluate the accuracy, effectiveness, and efficiency of the University's electronic information and processing systems
Determine the effectiveness and efficiency of organizations in accomplishing their mission and identify operational opportunities for cost savings and revenue enhancements
Provide assistance and a coordinated audit effort with the Indiana State Board of Accounts and other external auditors
Investigate fiscal misconduct

VALUES

In carrying out our mission, we share certain beliefs and values.

Our primary focus is to provide excellent service to the University. Our examinations will be performed in accordance with applicable standards established by the American Institute of Certified Public Accountants (AICPA), Institute of Internal Auditors (IIA), Government Accounting Office (GAO), etc.
We are committed to the highest degree of fairness, integrity, and ethical conduct in the performance of our mission. We will adhere to the Code of Ethics as established by the Association of College and University Auditors (ACUA). Furthermore, we will not issue a report without first allowing the recipient the opportunity to review, challenge, question, and respond to our findings and conclusions.
Our relationships with the University community will be characterized by respect, helpfulness, sharing, patience, and openness.
We are committed to maintaining our professionalism as internal auditors through continuance of our education and training.
Although we are a part of the University we are committed to maintaining our independence in defining the scope and objectives of our examinations.

Standards for the Professional Practice of Internal Auditing (IIA)

100 INDEPENDENCE

Internal auditors should be independent of the activities they audit.

.01 Internal auditors are independent when they can carry out their work freely and objectively. Independence permits internal auditors to render the impartial and unbiased judgments essential to the proper conduct of audits. It is achieved through organizational status and objectivity.

110 ORGANIZATIONAL STATUS

The organizational status of the internal auditing department should be sufficient to permit the accomplishment of its audit responsibilities.

.01 Internal auditors should have the support of management and of the board of directors so that they can gain the cooperation of auditees and perform their work free from interference.

The director of the internal auditing department should be responsible to an individual in the organization with sufficient authority to promote independence and to ensure broad audit coverage, adequate consideration of audit reports, and appropriate action on audit recommendations.
The director should have direct communication with the board. Regular communication with the board helps assure independence and provides a means for the board and the director to keep each other informed on matters of mutual interest.
Independence is enhanced when the board concurs in the appointment or removal of the director of the internal auditing department.
The purpose, authority, and responsibility of the internal auditing department should be defined in a formal written document (charter). The director should seek approval of the charter by management as well as acceptance by the board. The charter should (a) establish the department's position within the organization; (b) authorize access to records, personnel, and physical properties relevant to the performance of audits; and (c) define the scope of internal auditing activities.
The director of internal auditing should submit annually to management for approval and to the board for its information a summary of the department's audit work schedule, staffing plan, and financial budget. The director should also submit all significant interim changes for approval and information. Audit work schedules, staffing plans, and financial budgets should inform management and the board of the scope of internal auditing work and of any limitations placed on that scope.
The director of internal auditing should submit activity reports to management and to the board annually or more frequently as necessary. Activity reports should highlight significant audit findings and recommendations and should inform management and the board of any significant deviations from approved audit work schedules, staffing plans, and financial budgets, and the reasons for them.

120 OBJECTIVITY

Internal auditors should be objective in performing audit.

.01 Objectivity is an independent mental attitude which internal auditors should maintain in performing audits. Internal auditors are not to subordinate their judgment on audit matters to that of others.
.02 Objectivity requires internal auditors to perform audits in such a manner that they have an honest belief in their work product and that no significant quality compromises are made. Internal auditors are not to be placed in situations in which they feel unable to make objective professional judgments.

Staff assignments should be made so that potential and actual conflicts of interest and bias are avoided. The director should periodically obtain from the audit staff information concerning potential conflicts of interest and bias.
Internal auditors should report to the director any situations in which a conflict of interest or bias is present or may reasonably be inferred. The director should then reassign such auditors.
Staff assignments of internal auditors should be rotated periodically whenever it is practicable to do so.
Internal auditors should not assume operating responsibilities. But if on occasion management directs internal auditors to perform nonaudit work, it should be understood that they are not functioning as internal auditors. Moreover, objectivity is presumed to be impaired when internal auditors audit any activity for which they had authority or responsibility. This impairment should be considered when reporting audit results.
Persons transferred to or temporarily engaged by the internal auditing department should not be assigned to audit those activities they previously performed until a reasonable period of time has elapsed. Such assignments are presumed to impair objectivity and should be considered when supervising the audit work and reporting audit results.
The results of internal auditing work should be reviewed before the related audit report is released to provide reasonable assurance that the work was performed objectively.

.03 The internal auditor's objectivity is not adversely affected when the auditor recommends standards of control for systems or reviews procedures before they are implemented. Designing, installing, and operating systems are not audit functions. Also, the drafting of procedures for systems is not an audit function. Performing such activities is presumed to impair audit objectivity.

200 PROFESSIONAL PROFICIENCY

Internal audits should be performed with proficiency and due professional care.

.01 Professional proficiency is the responsibility of the internal auditing department and each internal auditor. The department should assign to each audit those persons who collectively possess the necessary knowledge, skills, and disciplines to conduct the audit properly.

210 STAFFING

The internal auditing department should provide assurance that the technical proficiency and educational background of internal auditors are appropriate for the audits to be performed.

.01 The director of internal auditing should establish suitable criteria of education and experience for filling internal auditing positions, giving due consideration to scope of work and level of responsibility.
.02 Reasonable assurance should be obtained as to each prospective auditor's qualifications and proficiency.

220 KNOWLEDGE, SKILLS, AND DISCIPLINES

The internal auditing department should possess or should obtain the knowledge, skills, and disciplines needed to carry out its audit responsibilities.

.01 The internal auditing staff should collectively possess the knowledge and skills essential to the practice of the profession within the organization. These attributes include proficiency in applying internal auditing standards, procedures, and techniques.
.02 The internal auditing department should have employees or use consultants who are qualified in such disciplines as accounting, economics, finance, statistics, electronic data processing, engineering, taxation, and law as needed to meet audit responsibilities. Each member of the department, however, need not be qualified in all of these disciplines.

230 SUPERVISION

The internal auditing department should provide assurance that internal audits are properly supervised.

.01 The director of internal auditing is responsible for providing appropriate audit supervision. Supervision is a continuing process, beginning with planning and ending with the conclusion of the audit assignment.
.02 Supervision includes:

Providing suitable instructions to subordinates at the outset of the audit and approving the audit program.
Seeing that the approved audit program is carried out unless deviations are both justified and authorized.
Determining that audit working papers adequately support the audit findings, conclusions, and reports.
Making sure that audit reports are accurate, objective, clear, concise, constructive, and timely.
Determining that audit objectives are being met.

.03 Appropriate evidence of supervision should be documented and retained.
.04 The extent of supervision required will depend on the proficiency of the internal auditors and the difficulty of the audit assignment.
.05 All internal auditing assignments, whether performed by or for the internal auditing department, remain the responsibility of its director.

240 COMPLIANCE WITH STANDARDS OF CONDUCT

Internal auditors should comply with professional standards of conduct.

.01 The Code of Ethics of The Institute of Internal Auditors sets forth standards of conduct and provides a basis for enforcement among its members. The Code calls for high standards of honesty, objectivity, diligence, and loyalty to which internal auditors should conform.

250 KNOWLEDGE, SKILLS, AND DISCIPLINES

Internal auditors should possess the knowledge, skills, and disciplines essential to the performance of internal audits.

.01 Each internal auditor should possess certain knowledge and skills as follows:

Proficiency in applying internal auditing standards, procedures, and techniques is required in performing internal audits. Proficiency means the ability to apply knowledge to situations likely to be encountered and to deal with them without extensive recourse to technical research and assistance.
Proficiency in accounting principles and techniques is required of auditors who work extensively with financial records and reports.
An understanding of management principles is required to recognize and evaluate the materiality and significance of deviations from good business practice. An understanding means the ability to apply broad knowledge to situations likely to be encountered, to recognize significant deviations, and to be able to carry out the research necessary to arrive at reasonable solutions.
An appreciation is required of the fundamentals of such subjects as accounting, economics, commercial law, taxation, finance, quantitative methods, and computerized information systems. An appreciation means the ability to recognize the existence of problems or potential problems and to determine the further research to be undertaken or the assistance to be obtained.

260 HUMAN RELATIONS AND COMMUNICATIONS

Internal auditors should be skilled in dealing with people and in communicating effectively.

.01 Internal auditors should understand human relations and maintain satisfactory relationships with auditees.
.02 Internal auditors should be skilled in oral and written communications so that they can clearly and effectively convey such matters as audit objectives, evaluations, conclusions, and recommendations.

270 CONTINUING EDUCATION

Internal auditors should maintain their technical competence through continuing education.

.01 Internal auditors are responsible for continuing their education in order to maintain their proficiency. They should keep informed about improvements and current developments in internal auditing standards, procedures, and techniques. Continuing education may be obtained through membership and participation in professional societies; attendance at conferences, seminars, college courses, and in-house training programs; and participation in research projects.

280 DUE PROFESSIONAL CARE

Internal Auditors should exercise due professional care in performing internal audits.

.01 Due professional care calls for the application of the care and skill expected of a reasonably prudent and competent internal auditor in the same or similar circumstances. Professional care should, therefore, be appropriate to the complexities of the audit being performed. In exercising due professional care, internal auditors should be alert to the possibility of intentional wrongdoing, errors and omissions, inefficiency, waste, ineffectiveness, and conflicts of interest. They should also be alert to those conditions and activities where irregularities are most likely to occur. In addition, they should identify inadequate controls and recommend improvements to promote compliance with acceptable procedures and practices.
.02 Due care implies reasonable care and competence, not infallibility or extraordinary performance. Due care requires the auditor to conduct examinations and verifications to a reasonable extent, but does not require detailed audits of all transactions. Accordingly, the internal auditor cannot give absolute assurance that noncompliance or irregularities do not exit. Nevertheless, the possibility of material irregularities or noncompliance should be considered whenever the internal auditor undertakes an internal auditing assignment.
.03 When an internal auditor suspects wrongdoing, the appropriate authorities within the organization should be informed. The internal auditor may recommend whatever investigation is considered necessary in the circumstances. Thereafter, the auditor should follow up to see that the internal auditing department's responsibilities have been met.
.04 Exercising due professional care means using reasonable audit skill and judgment in performing the audit. To this end, the internal auditor should consider:

The extent of audit work needed to achieve audit objectives
The relative materiality or significance of matters to which audit procedures are applied
The adequacy and effectiveness of internal controls
The cost of auditing in relation to potential benefits
Due professional care includes evaluating established operating standards and determining whether those standards are acceptable and are being met. When such standards are vague, authoritative interpretations should be sought. If internal auditors are required to interpret or select operating standards, they should seek agreement with auditees as to the standards needed to measure operating performance.

300 SCOPE OF WORK

The scope of the internal audit should encompass the examination and evaluation of the adequacy and effectiveness of the organization's system of internal control and the quality of performance in carrying out assigned responsibilities.

.01 The scope of internal auditing work, as specified in this standard, encompasses what audit work should be performed. It is recognized, however, that management and the board of directors provide general direction as to the scope of work and the activities to be audited.
.02 The purpose of the review for adequacy of the system of internal control is to ascertain whether the system established provides reasonable assurance that the organization's objectives and goals will be met efficiently and economically.
.03 The purpose of the review for effectiveness of the system of internal control is to ascertain whether the system is functioning as intended.
.04 The purpose of the review for quality of performance is to ascertain whether the organization's objectives and goals have been achieved.
.05 The primary objectives of internal control are to ensure:

The reliability and integrity of information.
Compliance with policies, plans, procedures, laws, and regulations.
The safeguarding of assets.
The economical and efficient use of resources.
The accomplishment of established objectives and goals for operations or programs.

310 RELIABILITY AND INTEGRITY OF INFORMATION

Internal auditors should review the reliability and integrity of financial and operating information and the means used to identify, measure, classify, and report such information.

.01 Information systems provide data for decision making, control, and compliance with external requirements. Therefore, internal auditors should examine information systems and, as appropriate, ascertain whether:

Financial and operating records and reports contain accurate, reliable, timely, complete, and useful information.
Controls over record keeping and reporting are adequate and effective.

320 COMPLIANCE WITH POLICIES, PLANS, PROCEDURES, LAWS, AND REGULATIONS

Internal auditors should review the systems established to ensure compliance with those policies, plans, procedures, laws and regulations which could have a significant impact on operations and reports, and should determine whether the organization is in compliance.

.01 Management is responsible for establishing the systems designed to ensure compliance with such requirements as policies, plans, procedures, and applicable laws and regulations. Internal auditors are responsible for determining whether the systems are adequate and effective and whether the activities audited are complying with the appropriate requirements.

330 SAFEGUARDING OF ASSETS

Internal auditors should review the means of safeguarding assets and, as appropriate, verify the existence of such assets.

.01 Internal auditors should review the means used to safeguard assets from various types of losses such as those resulting from theft, fire, improper or illegal activities, and exposure to the elements.
.02 Internal auditors, when verifying the existence of assets, should use appropriate audit procedures.

340 ECONOMICAL AND EFFICIENT USE OF RESOURCES

Internal auditors should appraise the economy and efficiency with which resources are employed.

.01 Management is responsible for setting operating standards to measure an activity's economical and efficient use of resources. Internal auditors are responsible for determining whether:

Operating standards have been established for measuring economy and efficiency.
Established operating standards are understood and are being met.
Deviations from operating standards are identified, analyzed, and communicated to those responsible for corrective action.
Corrective action has been taken.

.02 Audits related to the economical and efficient use of resources should identify such conditions as:

Underutilized facilities.
Nonproductive work.
Procedures which are not cost justified.
Overstaffing or understaffing.

350 ACCOMPLISHMENT OF ESTABLISHED OBJECTIVES AND GOALS FOR OPERATIONS OR PROGRAMS

Internal auditors should review operations or programs to ascertain whether results are consistent with established objectives and goals and whether the operations or programs are being carried out as planned.

.01 Management is responsible for establishing operating or program objectives and goals, developing and implementing control procedures, and accomplishing desired operating or program results. Internal auditors should ascertain whether such objectives and goals conform with those of the organization and whether they are being met.
.02 Internal auditors can provide assistance to managers who are developing objectives, goals, and systems by determining whether the underlying assumptions are appropriate; whether accurate, current, and relevant information is being used; and whether suitable controls have been incorporated into the operations or programs.

400 PERFORMANCE OF AUDIT WORK

Audit work should include planning the audit, examining and evaluating information, communicating results and following up.

.01 The internal auditor is responsible for planning and conducting the audit assignment, subject to supervisory review and approval.

410 PLANNING THE AUDIT

Internal auditors should plan each audit.

.01 Planning should be documented and should include:

Establishing audit objectives and scope of work.
Obtaining background information about the activities to be audited.
Determining the resources necessary to perform the audit.
Communicating with all who need to know about the audit.
Performing, as appropriate, an on-site survey to become familiar with the activities and controls to be audited, to identify areas for audit emphasis, and to invite auditee comments and suggestions.
Writing the audit program.
Determining how, when, and to whom audit results will be communicated.
Obtaining approval of the audit work plan.

420 EXAMINING AND EVALUATING INFORMATION

Internal auditors should collect, analyze, interpret, and document information to support audit results.

.01 The process of examining and evaluating information is as follows:

Information should be collected on all matters related to the audit objectives and scope of work.
Information should be sufficient, competent, relevant, and useful to provide a sound basis for audit findings and recommendations. Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Competent information is reliable and the best attainable through the use of appropriate audit techniques. Relevant information supports audit findings and recommendations and is consistent with the objectives for the audit. Useful information helps the organization meet its goals.
Audit procedures, including the testing and sampling techniques employed, should be selected in advance, where practicable, and expanded or altered if circumstances warrant.
The process of collecting, analyzing, interpreting, and documenting information should be supervised to provide reasonable assurance that the auditor's objectivity is maintained and that audit goals are met.
Working papers that document the audit should be prepared by the auditor and reviewed by management of the internal auditing department. These papers should record the information obtained and the analyses made and should support the bases for the findings and recommendations to be reported.

430 COMMUNICATING RESULTS

Internal auditors should report the results of their audit work.

.1 A signed, written report should be issued after the audit examination is completed. Interim reports may be written or oral and may be transmitted formally or informally.
.2 The internal auditor should discuss conclusions and recommendations at appropriate levels of management before issuing final written reports.
.3 Reports should be objective, clear, concise, constructive, and timely.
.4 Reports should present the purpose, scope, and results of the audit; and, where appropriate, reports should contain an expression of the auditor's opinion.
.5 Reports may include recommendations for potential improvements and acknowledge satisfactory performance and corrective action.
.6 The auditee's views about audit conclusions or recommendations may be included in the audit report.
.7 The director of internal auditing or designee should review and approve the final audit report before issuance and should decide to whom the report will be distributed.

440 FOLLOWING UP

Internal auditors should follow up to ascertain that appropriate action is taken on reported audit findings.

.01 Internal auditing should determine that corrective action was taken and is achieving the desired results, or that management or the board has assumed the risk of not taking corrective action on reported findings.

500 MANAGEMENT OF THE INTERNAL AUDITING DEPARTMENT

The director of internal auditing should properly manage the internal auditing department.

.01 The director of internal auditing is responsible for properly managing the department so that:

Audit work fulfills the general purposes and responsibilities approved by management and accepted by the board.
Resources of the internal auditing department are efficiently and effectively employed.
Audit work conforms to the Standards for the Professional Practice of Internal Auditing.

510 PURPOSE, AUTHORITY, AND RESPONSIBILITY

The director of internal auditing should have a statement of purpose, authority, and responsibility for the internal auditing department.

.01 The director if internal auditing is responsible for seeking the approval of management and the acceptance by the board of a formal written document (charter) for the internal auditing department.

520 PLANNING

The director of internal auditing should establish plans to carry out the responsibilities of the internal auditing department.

.01 These plans should be consistent with the internal auditing department's charter and with the goals of the organization.
.02 The planning process involves establishing:

Goals.
Audit work schedules.
Staffing plans and financial budgets.
Activity reports.

.03 The goals of the internal auditing department should be capable of being accomplished within specified operating plans and budgets and, to the extent possible, should be measurable. They should be accompanied by measurement criteria and targeted dates of accomplishment.
.04 Audit work schedules should include (a) what activities are to be audited; (b) when they will be audited; and (c) the estimated time required, taking into account the scope of the audit work planned and the nature and extent of audit work performed by others. Matters to be considered in establishing audit work schedule priorities should include (a) the date and results of the last audit; (b) financial exposure; (c) potential loss and risk; (d) requests by management; (e) major changes in operations, programs, systems, and controls; (f) opportunities to achieve operating benefits; and (g) changes to and capabilities of the audit staff. The work schedules should be sufficiently flexible to cover unanticipated demands on the internal auditing department.
.05 Staffing plans and financial budgets, including the number of auditors and the knowledge, skills, and disciplines required to perform their work, should be determined from audit work schedules, administrative activities, education and training requirements, and audit research and development efforts.
.06 Activity reports should be submitted periodically to management and to the board. These reports should compare (a) performance with the department's goals and audit work schedules and (b) expenditures with financial budgets. They should explain the reasons for major variances and indicate any action taken or needed.

530 POLICIES AND PROCEDURES

The director of internal auditing should provide written policies and procedures to guide the audit staff.

.01 The form and content of written policies and procedures should be appropriate to the size and structure of the internal auditing department and the complexity of its work. Formal administrative and technical audit manuals may not be needed by all internal auditing departments. A small internal auditing department may be managed informally. Its audit staff may be directed and controlled through daily, close supervision and written memoranda. In a large internal auditing department, more formal and comprehensive policies and procedures are essential to guide the audit staff in the consistent compliance with the department's standards of performance.

540 PERSONNEL MANAGEMENT AND DEVELOPMENT

The director of internal auditing should establish a program for selecting and developing the human resources of the internal auditing department.

.01 The program should provide for:

Developing written job descriptions for each level of the audit staff.
Selecting qualified and competent individuals.
Training and providing continuing educational opportunities for each internal auditor.
Appraising each internal auditor's performance at least annually.
Providing counsel to internal auditors on their performance and professional development.

550 EXTERNAL AUDITORS

The director of internal auditing should coordinate internal and external audit efforts.

.01 The internal and external audit work should be coordinated to ensure adequate audit coverage and to minimize duplicate efforts.
.02 Coordination of audit efforts involves:

Periodic meetings to discuss matters of mutual interest.
Access to each other's audit programs and working papers.
Exchange of audit reports and management letters.
Common understanding of audit techniques, methods, and terminology.

560 QUALITY ASSURANCE

The director of internal auditing should establish and maintain a quality assurance program to evaluate the operations of the internal auditing department.

.01 The purpose of this program is to provide reasonable assurance that audit work conforms with these Standards, the internal auditing department's charter, and other applicable standards. A quality assurance program should include the following elements:

Supervision.
Internal reviews.
External reviews.

.02 Supervision of the work of the internal auditors should be carried out continually to assure conformance with internal auditing standards, departmental policies, and audit programs.
.03 Internal reviews should be performed periodically by members of the internal auditing staff to appraise the quality of the audit work performed. These reviews should be performed in the same manner as any other internal audit.
.04 External reviews of the internal auditing department should be performed to appraise the quality of the department's operations. These reviews should be performed by qualified persons who are independent of the organization and who do not have either a real or an apparent conflict of interest. Such reviews should be conducted at least once every three years. On completion of the review, a formal, written report should be issued. The report should express an opinion as to the department's compliance with the Standards for the Professional Practice of Internal Auditing and, as appropriate, should include recommendations for improvement.

Code of Ethics (ACUA/IIA)

STANDARDS OF CONDUCT

Members and CIAs shall exercise honesty, objectivity, and diligence in the performance of their duties and responsibilities.
Members and CIAs shall exhibit loyalty in all matters pertaining to the affairs of their organization or to whomever they may be rendering a service. However, Members and CIAs shall not knowingly be a party to any illegal or improper activity.
Members and CIAs shall not knowingly engage in acts or activities which are discreditable to the profession of internal auditing or to their organization.
Members and CIAs shall refrain from entering into any activity which may be in conflict with the interest of their organization or which would prejudice their ability to carry out objectively their duties and responsibilities.
Members and CIAs shall not accept anything of value from an employee, client, customer, supplier, or business associate of their organization which would impair or be presumed to impair their professional judgment.
Members and CIAs shall undertake only those services which they can reasonably expect to complete with professional competence.
Members and CIAs shall adopt suitable means to comply with the Standards for the Professional Practice of Internal Auditing.
Members and CIAs shall be prudent in the use of information acquired in the course of their duties. They shall not use confidential information for any personal gain nor in any manner which would be contrary to law or detrimental to the welfare of their organization.
Members and CIAs, when reporting on the results of their work, shall reveal all material facts known to them which, if not revealed, could either distort reports of operations under review or conceal unlawful practices.
Members and CIAs shall continually strive for improvement in their proficiency, and in the effectiveness and quality of their service.
Members and CIAs, in the practice of their profession, shall be ever mindful of their obligation to maintain the high standards of competence, morality and dignity promulgated by The Institute. Members shall abide by the Bylaws and uphold the objectives of The Institute.

Independence/Objectivity/Confidentiality/Conduct

INDEPENDENCE/OBJECTIVITY

To be effective in performing audits the audit staff must be independent and objective both in actuality and perception. We maintain our independence by our organizational position (including reporting line to the Board) and our Board approved AUTHORIZATION AND RESPONSIBILITIES (see CHARTER).

In order to maintain objectivity, auditors will immediately inform the audit administration of any factors that may be perceived as impairing their objectivity on an assigned audit. Also, auditors will take great care to prevent even a perception of partiality by maintaining a professional distance from the staff of a department while performing an audit. Questions concerning any relationships with auditees or potential auditees (i. e., preparing tax returns, attending parties, etc.) should be brought to the attention of the audit administration. Finally, auditors will not accept anything of value from an employee, supplier, or business associate of the University which would impair or be perceived to impair their professional judgement or objectivity. Any gifts accepted will be immediately reported to audit administration.

CONFIDENTIALITY

Much of the information available to internal auditors is of a sensitive or confidential nature. Auditors should be prudent in their use of information acquired in the course of their duties or information which is available to them. They will not discuss any matters pertaining to the audits performed by the departments in other then an official manner.

Auditors shall not use confidential information for any personal gain or in a manner which would be detrimental to the University or any employee or student of the University. (See the Institute of Internal Auditor's Code of Ethics).

Auditors will take adequate measures to prevent the unauthorized release of confidential materials or information in any medium including paper copies, microfiche, or computer files. Such materials should be adequately secured from theft, reproduction, or casual observation.

Confidential materials include any information (except public information) associated with student or employee names, social security numbers, or identification numbers. Examples of confidential information include, but are not limited to the following:

Student or employee medical or psychological records.
Course enrollment or grades.
Financial aid records.
Student or parent financial status records.
Employee personnel, benefit, or payroll information.
Any information which could cause the University embarrassment or liability.

CONDUCT

The following guidelines are established regarding personal conduct and the confidentiality of audit or business information acquired through audit assignments.

As a member of the Internal Audit staff, you are representing the highest level of management. Conduct yourself in a manner that reflects favorably upon yourself and those you represent. You are expected to exercise professional skill, integrity, maturity of behavior, and tact in your relations with others. In general, you are encouraged to be friendly with all University employees without affecting your objectivity. You should guard against any conduct or mannerisms which permit an impression that you consider yourself an "expert" sent to check on employees. As far as possible, take the position of an independent/objective analyst and advisor. Avoid the image of policing.
In the course of your assignments, you will be in contact with personnel at all levels of authority and position. At all times, an independence in mental attitude is to be maintained. Reports resulting from your efforts should always contain full and unbiased disclosure of all but minor audit findings. Although you report to the Internal Audit department, you have responsibilities to both management and the personnel being audited.
Much of your work is confidential; therefore, be discreet on and off the job in discussing current or past audits or your personal assessments of audit customers. Judgment should be exercised in the security of audit work papers, programs, records, and information at all times.
Never indiscreetly discuss any information you obtain during audits.
Avoid extremes of dress or personal grooming.

Audit Process

PLANNING - GENERAL, RATIONALE

The assessment of audit risk is an integral part of our planning process. The audit planning process encompasses all activities related to the development of the internal audit plan and schedule and the determination of the audit scope and objectives, timing, design of detailed procedures, and audit recourse planning for the individual auditable entities. The primary objective of the audit planning process is to design our audit approach to ensure that audits are performed in the most effective and efficient manner. In undertaking this process we attempted the following:

Define the potential audit universe at the University
Define factors to be used in assessing risk
Quantify the potential risk associated with each of the defined audit areas
Schedule audits and allocate Internal Audit resources according to the priorities established and the current level and expertise of staff auditors

PLANNING - RESEARCH, SCHEDULING, AND AUDITS

Internal Audit's scheduling process begins with requests for audit services (requests, or suggestions, come from several sources). One obvious source is our own Internal Audit staff. Our in-depth knowledge of the University gives us a unique perspective on the types of projects in which we can reduce the University's risk. Hence, some of our projects originate in our own group or as a result of the annual audit of the University as a whole, which is conducted by the State Board of Accounts.

Several factors influence the selection and scheduling of projects: the degree of risk or exposure to loss; type of audit; current and planned work in other major audit projects requiring substantial time commitments of Internal Audit staff; the availability of staff in client units selected for review; and the availability of Internal Audit staff with the appropriate skills.

An analysis will be performed annually in order to quantify risk and schedule audits. This analysis will combine factual information and Internal Audit administration's judgment in the selection, ranking, and weighing of the various audit risk factors. It should be emphasized that the final determination as to which areas should be included in the audit plan cannot be based solely on the results of this audit risk assessment. Rather, the performance of the assessment is a tool for use by Internal Audit administration.

TYPES OF AUDITS

1. AUDIT

Operational - refers to a comprehensive examination of an operating unit or a complete organization to evaluate its performance, as measured by management's objectives. An operational audit focuses on the efficiency, effectiveness, and economy of operations.
Financial - Determine the accuracy and propriety of financial transactions.
Compliance - The objective of these audits is to determine whether, and to what degree, an organization conforms to certain specific requirements of policy, procedures, standards, or laws and governmental regulations. The auditor must know precisely what policies, procedures, standards, etc. are required. Usually, compliance audits require little preliminary survey work or review of internal controls, except to outline precisely what requirements are being audited. The audit focuses almost exclusively upon detailed testing of conditions.
Asset Verification - An independent appraisal of University operations is provided through the verification of accountability, physical safeguards, and valid use of distributed University assets. This is often performed in conjunction with an audit.

2. LOSS

Loss/fraud investigations - conducted to determine existing control weaknesses, assist University Risk Management in determining the amount of the loss/fraud, and assist the unit by recommending corrective measures to prevent subsequent recurrences. Investigation of allegations may also be conducted.

3. INFORMATION SYSTEMS AUDIT

The primary mission of the Information Systems audit function of Internal Audit is to support the internal audit function in the evaluation of the accuracy, effectiveness, and efficiency of the University's electronic and information processing systems which are in production or under development.

4. MISCELLANEOUS

Consultant Services - Information, encouragement, and review will be provided on issues concerning University policies, procedures, and internal controls. With the addition of an information systems audit function consultation services are expanded to include:

Assistance on evaluation of backup procedures and contingency planning
Assistance on whether a defined architecture has proper controls
Information on computer controls
Assistance on implementation of internal financial system

Computer System Design and Enhancement - Internal Audit actively participates in the development of new systems or enhancements to current systems to promote the design of adequate internal controls prior to implementation and reduce the need for corrective measures at a later date.
Other Departmental Duties - Such as organizing the annual retreat, preparing the annual Trustee's report, etc., as assigned by the Director.

5. DEPARTMENT ADMINISTRATIVE REVIEWS

Pre-approved programs are used to audit accuracy and propriety of expenditures and payroll transactions. Income will be audited if the amount is material. These reviews may also include asset confirmations. Internal controls for income may also be reviewed if dollar amount is material.

6. FOLLOW-UP REVIEW

Follow-up reviews are performed to appraise management of post audit actions and provide assurance that implemented changes adequately resolved audit findings. These reviews also ensure that upper management has been properly notified of the University exposure related to unresolved audit findings.

7. CASH COUNT

A cash count is performed to determine custodial fund accountability which may include one or more of the following types of funds: petty cash fund, change fund, or revolving fund. A pre-approved cash count audit program is utilized for this type of audit.

Audit Assignment

All audits/tasks will be authorized by the Audit administration using an audit assignment sheet. The objective of this process is to assure that work is performed on only authorized activity. This form will provide sufficient information on the audit/task scope, objectives, and resource restrictions (allocated hours, expected completion date) so the assigned auditor(s) will have a clear understanding of Audit administration's expectations for their particular assignment.

DEFINITION OF TERMS ON THE ASSIGNMENT SHEET

Task Number: A five digit number used to identify the project
Type: The type of project indicated on the assignment form:

A=audit;
L=loss;
C=cash count;
F=follow-up;
M=miscellaneous;
T=continuing education-no trackable hours;
E=continuing education;
D=Information Systems audit;
X=task cancelled;
R=department administrative review.

Campus - Location of audit:

BL=Bloomington;
CE=Central;
IN=Indianapolis;
NW=Northwest;
SB=South Bend;
KO=Kokomo;
EA=East;
CO=Columbus;
SE=Southeast;
HO=Hospitals.

Title of Project: A short description of the project
Assignment Date: Beginning date that hours can be charged to the project
Allocated Hours: Time budgeted for this project. Any deviation from these hours must be approved by the Audit administration
Expected Completion Date: The date the report is expected to be issued in final
Assigned Staff: Names of the Quality Assurance Reviewer, Project Manager, Assigned Staff, Project Consultant, Participant, Instructor, and Nonactive staff should be listed on assignment sheet with project hours that are assigned to each
Scope & Objectives: A short description of the scope and objectives that will be covered
Fiscal Year: Fiscal year to be audited

SCOPE AND OBJECTIVES

The scope section will define the limitations of the audit/task assignment. The scope will generally include a time period, and what records, processes, funds, transactions, policies, controls, etc., we will be reviewing. Scope limitations that very narrowly restrict audit work should be mentioned in the audit report. (example: We did not test actual expenditure transactions.)
The objectives will explain what the audit is trying to accomplish. Audit objectives will generally include one or more of the following:

Determine the accuracy and propriety of financial transactions
Evaluate financial and operational procedures for adequacy of internal controls and provide advice and guidance on control aspects of new policies, systems, processes, and procedures
Verify the existence of University assets and ensure that proper safeguards are maintained to protect them from loss
Determine the level of compliance with University policies and procedures, state and federal laws and government regulations
Evaluate the accuracy, effectiveness, and efficiency of the University's electronic information and processing systems
Determine the effectiveness and efficiency of organizations in accomplishing their mission and identify operational opportunities for cost savings and revenue enhancements
Provide assistance and a coordinated audit effort with the Indiana State Board of Accounts and other external auditors
Determine if a loss occurred, if so the amount of the loss and circumstances (control weaknesses) that contributed to it.

DUTIES/RESPONSIBILITIES

AUDIT ADMINISTRATION

Audit Administration, the Director and Associate Director of Internal Audit, will be responsible for ensuring that audit resources are efficiently and effectively employed and that the audit work performed fulfills the mission of the department.

AUDIT MANAGER

The auditor in charge of the task will normally be an audit manager and will have the following duties and responsibilities:

Attend entrance and exit interviews
Discuss, direct, advise, etc., the assigned auditors during the course of the assignment including writing the report
Will be responsible for assuring the audit program steps will accomplish the objectives, address major risk and exposures, and will reasonably assure the completion of the assignment within allocated resources. Final approval of the audit program will be done by Audit Administration
Review, edit, and approve the draft report
Assure the audit is performed according to department standards, staying within the scope and resource allocation limits (hours and dates), and meet stated assigned objectives.

ASSIGNED AUDITOR(S)

Assigned auditor(s) will be responsible for performing the audit and will have the following duties and responsibilities:

Perform the preliminary review, including the internal control evaluation, with guidance from the Audit Manager
After discussions with the Audit Manager, prepare an audit program and time estimate for each program section
Perform all assigned activities in conformance with department standards, staying within the scope and resource allocation limits of the assigned activity or program section
Write the draft audit report

An assigned auditor who is also the Audit Manager of the project will have the additional duties of Audit Manager.

QUALITY ASSURANCE REVIEWER

All working papers should be independently reviewed to ensure there is sufficient evidence to support conclusions and that all audit objectives have been met. A detailed review will be conducted by the Audit Manager for assigned staff's working papers and a less comprehensive review will be conducted by department administration or an assigned Quality Assurance staff person. Initialing working papers (see "review/approval form") signing the "review/approval form," and filing "cleared" review notes in the current working papers will serve as documentation of the review process.
The reviewer should:

Determine working paper's compliance to general department working paper standards
Review from audit program steps to the referenced working papers ensuring cross-referencing is proper, the working papers support the steps performed, and all steps have been completed
Review working paper's from the report(s) to the Digest of Significant Findings to the working paper summaries to the detailed working papers to ensure that all findings are stated adequately and documented and support the opinions, findings, and recommendations stated in the report
Ensure that working papers "stand alone" in that they are clearly stated what work was performed, how and from where samples were selected, the purpose of the working paper, what findings were made, etc.
Document review comments on review notes form
After all audit review notes have been resolved, sign off on working paper section of final working paper/report approval form
Determine report(s) compliance with general department report standards
Sign off on report(s) section of final working paper/report approval form
Determine Permanent/Continuing Audit File's compliance with department standards

PROJECT CONSULTANT

The project consultant's primary duties and responsibilities are to advise and provide guidance to the assigned auditors. The project consultant does not take an active role in the project, but will be on call to answer questions or volunteer suggestions as applicable.

REPORT REVIEWER

The Report Reviewer primary responsibility is to provide a final independent review of audit reports to help ensure that proper grammar, spelling, and department format has been used. The Report Reviewer will also perform or supervise the:

Print revised draft copies for Directors approval
Print final report copy for auditors and director signature
Mail final report copy
Filing of electronic copy on LAN
Update ARMS: mark complete, recommendation categories, mark complete, create follow-up when necessary, etc.
Mailing feedback questionnaire
Updating feedback spreadsheet when feedback received
Adding response to electronic copy of report and filing paper copy with final report
Creating follow-up working papers, trustee report, electronic copy of report on LAN, etc.
Updating Trustee report

ANNOUNCEMENT LETTER

Auditee Notification:

The client will be informed of the audit project through an announcement letter from the Internal Audit Director. However, Internal Audit will not provide advance notifications for cash counts and fraud investigations. Additionally, Internal Audit may not send an announcement letter for requested consulting services.
The announcement letter will communicate the scope and objectives of the audit, the period covered, and the auditor(s) assigned to the project. Internal Audit's mission statement will also be enclosed for the clients information.

Preliminary Review -General, Rationale

The objective of the Preliminary Review is to gain sufficient knowledge of the unit being reviewed so the auditor can design an audit program to accomplish the assigned objectives. The review will help the auditor to determine if the assigned objectives are attainable with the allocated resources and what audit procedures should be performed, based on assessed risks and exposures, to achieve the objectives.
The preliminary review work can be broken down into four distinct phases:

Familiarization
Identification of potential problem areas
Evaluation of internal controls
Planning the detailed audit

One of the problems in performing an effective preliminary review is the failure to complete all phases of the review prior to preparing the formal audit program and beginning the fieldwork.

INITIAL RESEARCH (FAMILIARIZATION)

Prior to meeting with the auditee the assigned auditor(s) will obtain a basic understanding of the operation or system under review. This review will normally include:

Review of Permanent/Continuing Audit File (if one exists)
Review of Previous Audit Working Papers, Reports, Management letters (if available)
Review of department financial statements (transactions) including historical trends if available
Review of department organization and staffing (payroll/personnel listing)
Review of department equipment listing
Consultations with other audit staff who have been involved in similar audits or are familiar with this department, related FOCUS files, systems, etc.
Review department focus
Review department's mission statement, organization chart and other information requested in the "announcement" letter"
Review and research for applicable laws, regulations, and departmental policies and procedures
Conduct the initial meeting with customer

IDENTIFICATION OF POTENTIAL PROBLEM AREAS

An objective of the preliminary review is the identification of potential problem areas. One of the first steps in determining problem areas is to identify those programs, activities, and functions which are significant. These can be identified as those programs or activities:

Which are susceptible to fraud, abuse, or mismanagement
In which there is a large dollar volume of transactions or large investments in assets which are subject to loss if not carefully controlled
About which concerns have been expressed by management
In which prior audits have disclosed major weaknesses or deficiencies

This phase of the preliminary review should identify the significant activities of the area and what inherent risks exist. Once these activities and risks have been identified, the next step is to evaluate controls.
The auditor is responsible for determining how much reliance can be placed on the entity's controls to protect its assets, assure accurate information, assure compliance with applicable laws and regulations, promote efficiency and economy, and produce effective results.
A complete review of all controls is not always necessary because some controls may be irrelevant to basic issues which are the subject of the audit effort. Therefore, the auditor must identify those controls which are the most important and critical to the operation and concentrate on them. Some controls which can normally be identified as critical are those which are designed to protect against:

Substantial financial losses
Program violations
Mismanagement
Legal violations
Adverse publicity
Lack of program or mission accomplishment

The auditor's evaluation should include identification of areas in which essential controls appear to be weak, non-functioning, or missing.
Vast amounts of data are stored electronically. Internal Audit has a library of standardized FOCUS queries that will assist in obtaining some of this information. In addition, Data Direct on the World Wide Web can also be used to obtain reports about specific organizations.

REVIEW AND EVALUATION OF INTERNAL CONTROL ENVIRONMENT

The auditor will review the unit's internal control structure. In doing this, the auditor uses a variety of tools and techniques, including flow charts, interviews, data gathering, and analysis. The review of internal controls helps the auditor design tests to be performed in the fieldwork section of the audit.
The evaluation of the system of internal controls should provide reasonable, but not absolute, assurance that the fundamental elements of the system are sufficient to accomplish their intended purpose. The study and evaluation should be adequately documented and properly supported by results of tests, observations, and inquiries. The use of electronic data processing methods that can affect the reliability, accuracy, or usefulness of financial or statistical data, and reports should be included as part of the study and evaluation.
Internal controls are evaluated throughout the audit examination. Audit Managers should prepare the program to assist assigned staff in performing this aspect of the audit work. Generally, the guidelines are incorporated into an audit program in the form of internal control questionnaires, checklists, and specific audit tests and procedures. Although the written audit guidelines (programs) are invaluable aids, Audit Managers must ensure that each assigned staff member is familiar with the scope and objectives of the internal control review.
The review of the system of internal controls is performed by discussing the control procedures, methods, and plan of organization with audit customer officials. The auditor may use internal control questionnaires or checklists as well as written narrative memoranda, flow charts, a transaction walk through, and other applicable techniques in determining the adopted control procedures and the method and plan of organization. These techniques are preferred because they provide adequate documentation. In addition to discussions with audit customer officials, auditors make inquiries and perform observations relating to the system of internal controls. These inquiries and observations, and resulting findings and conclusions are also documented in the work papers. This documentation includes identifying control strengths and weaknesses and cross-referencing them to the audit tests and procedures concerned with substantive testing.
To assist in evaluating the system of internal control the auditor should consider the following:

Types of errors and irregularities that could occur.
Control procedures to prevent or detect such errors and irregularities.
Whether the procedures have been adopted and are being followed satisfactorily.
Weaknesses which would enable errors and irregularities to pass through existing control procedures.
The effect these weaknesses have on the nature, timing, and extent of auditing procedures to be applied.
Audit methods used to study and evaluate existing internal controls include:
Internal Control Questionnaires - These guide the auditor to query responsible managers regarding specific or general internal controls. The questionnaires are designed so that a negative response indicates a potential internal control weakness. A negative response will cause the auditor to determine whether compensating controls are in existence which would offset the negative response. We have standardized questionnaires for revenue, custodial funds, expenditures, payroll, capital equipment, and accounts receivable.
Narratives - These describe the system of internal control.
Flow Charts - A flow chart is beneficial because it visually depicts processes designed or intended for control purposes. Flow-charting provides the auditor with a good understanding of the process being evaluated.
Documentation supports the auditor's understanding of the internal controls. Audit work papers provide the support for the conclusions reached by the auditor regarding the study and evaluation of internal controls. Only those internal control functions, which are deemed critical or important to the strength within a particular transaction cycle, should be tested and evaluated. Working papers should be prepared to highlight the internal control attributes within the processes to be evaluated.
Tests of compliance are performed to obtain sufficient evidence that the system is operating in accordance with the understanding the auditor obtained from the review. These are performed for those control procedures or methods upon which the auditor has chosen to rely. Conversely, when the auditor determines that certain controls cannot be relied upon, tests of compliance are not ordinarily performed.
The nature, timing, and extent of tests of compliance are closely related to the control procedures and methods studied by the auditor. Additionally, the auditor must consider the availability of evidence and the audit effort required to test compliance. In considering the required audit effort, the auditor assesses whether precluding certain tests of compliance will reduce the reliance on the controls and procedures, and whether such reduced reliance significantly affects subsequent audit tests and procedures.

FLOWCHARTING

The primary purpose of preparing a flow chart is to identify the key control attributes--those attributes that achieve control objectives. This can efficiently point out cases of under/over control and processing redundancy.

GENERAL FLOW CHARTING GUIDELINES

Clarity and simplicity in presentation are essential. Mistaken use of extreme detail may tend to conceal rather than expose key points. Complexities such as exception controls can be better explained in attached memoranda. However, narrative explanations should be kept brief. In most cases, the combination of the flow chart and a narrative description tends to be far superior to either document alone.
Only transactions/documents with control significance should be shown (i.e., control over authorization, recording, safeguarding, reconciliation, and valuation). This can generally be accomplished by including only those activities within an application where data is initialized, changed, or transferred to other departments. For a process to be flow charted, it must be broken down into its component parts, namely actions and decisions. Also, the name(s) and position(s) of the people performing the transactions should be indicated for each action. The names of each document should also be included within the document symbols.
The auditor usually obtains information necessary for preparing or updating flow charts by interviewing personnel at each site about procedures followed, and by reviewing procedure manuals, existing flow charts and other system documentation. Sample documents are collected and each department involved is questioned about its specific duties. Inquiries can be made concurrently with the performance of transaction reviews, particularly when flow charts are being updated. If possible, the auditor should observe the process.

INTERNAL CONTROL QUESTIONNAIRES

The primary purpose of completing the internal control questionnaire is to identify critical areas, strengths, and weakness in process. We have standardized questionnaires for revenue, custodial funds, expenditures, payroll, capital equipment, and accounts receivable. The Audit Manager should add questions to these standardized questionnaires if he/she believes they do not adequately cover the area under review.

PLANNING THE DETAILED AUDIT

The elements of materiality and relative risk must be considered in performing the audit. The due professional care standards do not imply unlimited responsibility for disclosure of irregularities and other deficiencies. The auditor's principal effort should be in those areas where significant problems or deficiencies may exist, rather than in areas that are relatively unimportant. Time should not be spent examining or developing evidence beyond what is necessary to afford a sound basis for a professional opinion.
The results of the preliminary review should be analyzed to determine the need for a detailed audit and the specific areas to be covered. The detailed audit program should be prepared allocating the project budget time established for the fieldwork to the specific areas to be covered in the audit.

STATEMENT OF RISK AND EXPOSURE

Rationale:

A risk/exposure analysis will be performed to prioritize audit testing that must be performed to achieve the audit objectives. This determination is essential for providing reasonable assurance that internal audit resources are deployed in an optimal manner (i.e., the most time is spent examining areas with the greatest risk exposure).
The three types of risks that will be considered are:

Inherent Risk - The risk related to the fundamental characteristics of the assigned area (i.e., an area that receives income in the form of currency and coin has a greater inherent risk of theft of that income then one that receives internal billing income form another department).
Control Risk - The risk that the assigned areas internal control system would fail to prevent or detect a significant intentional or unintentional error in the process.
Detection Risk - The risk that the internal audit would fail to detect errors that had occurred.

Exposure is the potential loss or liability to the University. It is not only loss of money but also the University's reputation, etc.
A Risk/Exposure analysis will involve determining the highest possible combined factors. (high risk/high exposure as opposed to high risk/low exposure or low risk/high exposure)
Policy:

During the preliminary review/internal control evaluation stage of the audit, the auditor will make a determination of what areas contain the greatest risks and potential exposures. This determination will be discussed with the audit administration before the audit program is written.

Process:

During the preliminary review/internal control evaluation stage of the audit, the auditor will complete a schedule detailing the greatest risks and potential exposures and discuss with audit administration.

Permanent/Continuing Audit Files

A permanent file should give the auditor general knowledge about the unit. The information in the file is not expected to change significantly from year-to-year, but it is pertinent to the current year's audit. Prior year's financial would aid the auditor in gathering general knowledge about the unit. It might also be useful in comparing the current year to the prior year or performing analyses. A permanent file should only be prepared for audits that we continually do or if the area audited is a system such as payroll, accounts payable, etc. Before a permanent file is established, consult with the Audit Manager and audit administration. If a permanent file is not prepared, useful information can be filed in section D of the working papers.

Audit Program

Preparation of the audit program concludes the Preliminary Review phase. The audit program outlines the necessary steps to achieve the objectives of the audit within the defined scope as listed on the assignment sheet. The audit program is a detailed plan for the work to be performed during the audit. A well-constructed program is essential to completing the audit project in an efficient manner.
A well constructed program provides:

A systematic plan for each phase of the work that can be communicated to all audit personnel concerned
A means of self control for the audit staff assigned
A means by which the audit supervisor/manager can review and compare performance with approved plans
Assistance in training inexperienced staff members and acquainting them with the scope, objectives, and work steps of an audit
An aid to supervisor/manager making possible a reduction in the amount of direct supervisory effort needed
Assistance in familiarizing successive audit staff with the nature of work previously carried out

The program consists of specific directions for carrying out the assignment. It should contain a statement of the objectives of the operation being reviewed. For each segment of the audit the program should (1) list the risks that must be covered in that segment; (2) show for each risk the controls that exist or that are needed to protect against the indicated risk; (3) show for each of the listed controls the work steps required to test the effectiveness of those controls, or set forth the recommendations that will be required to install needed controls; and (4) provide space for referencing the related audit work papers.
Departmental standardized audit programs are available and should be used or modified to achieve the audit objectives. The auditor includes an estimate of the hours necessary to complete the project. Internal Audit administration reviews the auditor's work to-date (preliminary review work) and then discusses any concerns or proposed program changes.

OBJECTIVES

The audit program should contain a statement of the objectives of the area being reviewed. The statement of objectives in the audit program should correspond with the audit objectives stated in the assignment sheet. These objectives should be achieved through the detailed audit program steps.

AUDIT STEPS

A well-constructed audit program provides specific, detailed steps (procedures) for achieving the audit objectives. Standardized audit programs with specific audit steps for achieving objectives are available and should be used or modified.

TIME BUDGET

A project time budget provides overall guidelines for the performance of the audit. In addition, it enables the audit manager to control the audit work in process. It is essential that we control our time carefully in order that it may be utilized in the most effective manner possible. The detailed project time budget should be completed at the conclusion of the preliminary review.
Each project will have a time budget that will be approved by the audit manager and audit administration. This budget will include all time necessary to complete the audit, from assignment through issuance of the final report. The preliminary review phase should be completed when no more than 25 percent of the total time budget has been depleted.
The budget process will be broken down into two phases. A portion of the budget should be allocated for the planning process. This will provide the necessary control over this phase of audit work.
Near the completion of the planning process, the remaining budget should be allocated to the rest of the audit and recorded on the Time Budget Summary. For purposes of overall control, the time budget should be broken down into the following general categories (more may be used if warranted):

Planning - initial planning, preliminary survey, audit program
Fieldwork - allocated to the various segments of the audit project
Audit report and wrap-up - audit manager's review, quality assurance review, report writing and editing, report review, auditee's review, exit conference, etc.)
Preparation and Approval - The project time budget should be prepared by the audit manager and approved by audit administration.
Budget Revisions -Any revisions to the project time budget should be discussed with audit administration at the earliest possible time and, when approved by audit administration, documented on the Time Budget Summary.

Fieldwork

EVIDENTIAL MATTER

Evidential matter obtained during the course of the audit provides the documented basis for the auditor's opinions, findings, and recommendations as expressed in the audit report. As internal auditors, we are obligated by our professional standards to act objectively, exercise due professional care, and collect sufficient, competent, relevant, and useful information to provide a sound basis for audit findings and recommendation (see examining and evaluating information).

AUDIT SAMPLING

Rationale:

Audit sampling is performing an audit test on less then 100 percent of a population. In 'sampling' the auditor accepts the risk that some or all errors will not be found and the conclusions drawn (i.e. all transactions were proper and accurate) may be wrong.

Types of Sampling:

Statistical or probability sampling allows the auditor to stipulate, with a given level of confidence, the condition of a large population by reviewing only a percentage of the total items. Several sampling techniques are available to the auditor.
Attribute sampling - is used when the auditor has identified the expected frequency or occurrence of an event.
Variables sampling - is used when the auditor samples for values in a population which vary from item to item.
Judgment sampling - is used when it is not essential to have a precise determination of the probable condition of the universe, or where it is not possible, practical, or necessary to use statistical sampling.

The type of sampling used and the number of items selected should be based on the auditors understanding of the relative risks and exposures of the areas audited.
Policy/Process:

All audit testing will include sampling. The type and sample size will be describe in the program and approved by audit administration.

TESTING AND WORKING PAPER DOCUMENTATION

Rationale/Policy/Purpose:

Working papers serve both as tools to aid the auditor in performing his work, and as written evidence of the work done to support the auditor's report. Information included in working papers should be sufficient, competent, relevant, and useful to provide a sound basis for audit findings and recommendations. Standard 420 of the Standards for the Professional Practice of Internal Auditing defines sufficient, competent, relevant, and useful as follows:

Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor.
Competent information is reliable and the best attainable through the use of appropriate audit techniques.
Relevant information supports audit findings and recommendations and is consistent with the objectives for the audit.
Useful information helps the organization meet its goals.

In addition to serving as a reference for the preparer when called upon to report findings or answer questions, other individuals may find it necessary to use the working papers.

Audit administration will use the papers to review the quality of the audit project and to evaluate the audit staff assigned to the work.
The manager whose unit is being audited may use details included in the working papers to help implement corrective action to a problem or refute the assertion that a problem exists.
University management or other individuals who may have requested the audit require timely reports. Well-organized working papers help to accomplish this goal.
External auditors review the work performed by the Department and evaluate the effect that its activities had on the University's system of internal control.
In fulfilling their public responsibility, certain regulatory agencies monitor University operations, and the Department's working papers may he subjected to their review. Solid working paper documentation is essential for questions from these and other potential outside reviewers.

QUALITIES OF GOOD WORKING PAPERS

Complete - Working papers must be able to "stand alone." This means that all questions must be answered, all points raised by the reviewer must be cleared, and a logical, well-thought out conclusion must be reached for each audit segment.
Concise - Working papers must be confined to those that serve a useful purpose.
Uniform - All working papers should be of uniform size and appearance. Smaller papers should be fastened to standard working papers, and larger papers should be folded to conform to size restrictions.
Neat - Working papers should not be crowded. Allow for enough space on each schedule so that all pertinent information can be included in a logical and orderly manner. At the same time, keep working papers economical. Forms and procedures should be included only when relevant to the audit or to an audit recommendation. Also, try to avoid unnecessary listing and scheduling. All schedules should have a purpose which relates to the audit procedures or recommendations.

WORKING PAPER TECHNIQUES

Descriptive Headings - All working papers should include the audit stamp, title of the audit, audit project number, title of the working paper, preparer's initials, date prepared, source of information, and purpose of the working paper.
Tick-marks - The auditor makes frequent use of a variety of symbols to indicate work that has been done. These symbols are commonly referred to as tick-marks. As these tick-marks have no special or uniform meaning in themselves, an explanation of each tick-mark should be made on the schedule on which it appears.
Cross-referencing - Cross-referencing within working papers should be complete and accurate. Working papers should be cross-referenced to the Audit Findings. Audit Findings should be cross-referenced to the exit conference memo and/or the audit report, to indicate final disposition of the item. Cross-referencing should be done in the margins of audit report drafts. These references readily provide direct access to the working papers.
Indexing - The system of indexing audit working papers should be simple, yet leave room for flexibility. A capital letter should be used to identify each segment of the audit, and Arabic numerals used to identify schedules within the segments.
Carry forward - The auditor should make full use of the working papers developed in the prior audit. Flow charts, system descriptions, and other data may still be valid. Those papers which remain useful should be made a part of the current working papers. They should be updated with current information, renumbered, referenced, initialed, and dated by the current auditor.

TYPES OF WORKING PAPERS

All working papers should be maintained in binders. Schedules, analyses, documents, flow charts, and narratives should be filed in a standard departmental binder. Documentation which is not of standard size should be mounted on standard size paper or referenced to a non-standard binder.

1. Schedules and Analyses

o Schedules and analyses are useful for identifying statistical trends, verifying the accuracy of data, developing projections or estimations, and determining if tasks or records have been properly completed. Each record review, data schedule, or analyses should include the following items:

� An explanation of its purpose (reference audit step)

� The methodology used to select the sample, make the calculation, etc.

� The criteria used to evaluate the data

� The source of data and time frame considered

� A summary of the results of the analyses

� The auditor's conclusion

2. Documents

o Copies or actual samples of various documents can be used as examples, for clarification, and as physical evidence to support a conclusion or prove the existence of a problem. These documents can be memos, reports, computer printouts, procedures, forms, invoices, flow charts, contracts, or any of numerous other items. Any copied document should serve a useful audit purpose.

o The following suggestions are offered for preparation of working papers using documents rather than the auditor's notes:

� Indicate both the person and/or file that the document came from (source).

� Copy and insert only that portion of the report, memo, procedure, etc., which is needed for purposes of explanation or as documentation of a potential finding. Do not include the entire document in the working papers unless absolutely necessary.

� Fully explain the terms and notations found on the document, as well as its use. This is especially true when including maps, engineering drawings, or flow charts in the papers. These explanations may be made on an attached preceding page or on the face of the document itself.

� Each document should be cross-referenced either to the page or separate analysis where it was discussed.

� No document should be included in the working papers without an explanation of why it was included.

� Documents larger than 8-1/2" x 11" should be reduced when practicable.

3. Process Write-ups and Flow charts

o In many audits, it is necessary to describe systems or processes followed by the audit customer. Describe such procedures or processes through the use of write-ups or flow charts or some combination of the two. The choice of which method to use will depend on the relative efficiency of the method in relation to the complexities of the system being described.

o Write-ups are often easier to use, and should be used, if the system or process can be described clearly and concisely. However, when write-ups would be lengthy, and description of related control points are difficult to integrate in the narrative, flow-charting (or a combination of write-ups and flow-charting) is an appropriate alternative. Flow charts conveniently describe complex relationships because they reduce narrative explanations to a picture of the system. They are concise and may be easier to analyze than written descriptions.

4. Interviews

o Most verbal information is obtained through formal interviews conducted either in person or by telephone. Formal interviews are most desirable because the interviewers know they are providing input to the audit; however, impromptu interviews, or even casual discussions can often provide important information. Any verbal information which is likely to support a conclusion in the audit working papers should be documented. Interviews are useful in identifying problem areas, obtaining general knowledge of the audit subject, collecting data not in a documented form, and documenting the audit customer's opinions, assessments, or rationale for actions. Interview notes should contain only the facts presented by the person interviewed, and not include any of the auditor's opinions.

o In preparing interviews for working papers, consider the following suggestions:

� Be sure to include the name and position title of all persons from whom information was obtained. This includes data gathered during casual conversations.

� Indicate when and where the meeting occurred.

� Organize notes by topic wherever possible.

� Identify sources of information quoted by interviewee.

5. Observations

o What the auditor observes can serve the same purposes as interviews. If observations can be used to support any conclusions, then they should be documented. They are especially useful for physical verifications.

o Observations used as supporting documentation should generally include the following items:

� Time and date of the observation

� Where the observation was made

� Who accompanied the auditor during the observation

� What was observed (when testing is involved, the working papers should include the sample selections and the basis of the sample)

6. Findings

o All audit findings must be documented in a SECTION SUMMARY (see next section) schedule in the working papers. Unfavorable findings will be summarized on a Digest of Significant Findings working paper whether or not they are to be included in the audit report. All findings should be documented immediately by the auditor discovering the situation.

STATING FINDINGS/CONCLUSIONS

Upon the conclusion of the fieldwork, the auditor summarizes the audit findings, conclusions, and recommendations necessary for preparation of the audit report discussion draft. Each audit finding will have documented in the SECTION SUMMARY the following ATTRIBUTES

Statement of Condition (What is!)
Criteria (What should be!)
Effect (So what?)
Cause (Why did it happen?)
Recommendation (What should be done?)

1. STATEMENT OF CONDITION

o The condition identifies the nature and extent of the find or unsatisfactory condition. It often answers the question: "What was wrong?" Normally, a clear and accurate statement of condition evolves from the auditor's comparison or results with appropriate evaluation criteria.

2. CRITERIA

o This attribute establishes the legitimacy of the finding by identifying the evaluation criteria and answers the question: "By what standards was it judged?" In financial and compliance audits, criteria could be accuracy, materiality, consistency, or compliance with applicable accounting principles and legal or regulatory requirements. In audits of efficiency, economy, and program results (effectiveness), criteria might be defined in mission, operation, or function statements; performance, production, and cost standards; contractual agreements; program objectives; policies, procedures, and other command media; or other external sources of authoritative criteria.

3. EFFECT

o This attribute identifies the real or potential impact of the condition and answers the question: "What effect did it have?"

o The significance of a condition is usually judged by its effect. In operational audits, reduction in efficiency and economy, or not attaining program objectives (effectiveness), are appropriate measures of effect. These are frequently expressed in quantitative terms; e.g., dollars, number of personnel, units of production, quantities of material, number of transactions, or elapsed time. If the real effect cannot be determined, potential or intangible effects can sometimes be useful in showing the significance of the condition.

4. CAUSE

o The fourth attribute identifies the underlying reasons for unsatisfactory conditions or findings, and answers the question: "Why did it happen?"

o If the condition has persisted for a long period of time or is intensifying, the contributing causes for these characteristics of the condition should also be described.

o Identification of the cause of an unsatisfactory condition or finding is a prerequisite to making meaningful recommendations for corrective action. The cause may be quite obvious or may be identified by deductive reasoning if the audit recommendation points out a specific and practical way to correct the condition. However, failure to identify the cause in a finding may also mean the cause was not determined because of limitation or defects in audit work, or was omitted to avoid direct confrontation with responsible officials.

5. RECOMMENDATIONS

o This final attribute identifies suggested remedial action and answers the question: "What should be one?"

o The relationship between the audit recommendation and the underlying cause of the condition should be clear and logical. If a relationship exists, the recommended action will most likely be feasible and appropriately directed.

o Recommendations in the audit report should state precisely what needs to be changed or fixed. How the change will be made is the client's responsibility. More generalized recommendations (e.g., greater attention be given, controls be re-emphasized, a study made, or consideration be given) should not be used in the audit report, but they are sometimes appropriate in summary reports to direct top management's attention to compliance-type findings disclosed in several areas.

o Unless benefits of taking the recommended action are obvious, they should be stated. The cost of implementing and maintaining recommendations should always be compared to risk.

o Recommendations should be directed to an individual capable of taking action.

6. POLICY/PROCESS

o Audit findings will include: the nature of the findings, the criteria used to determine the existence of the condition; the cause of the condition; the significance of its impact; and what the auditors think should be done to correct the situation.

Audit (Project) Quality Assurance Rationale, etc.

The purpose of "quality assurance" is to provide reasonable assurance that audit work performed by Indiana University - Internal Audit conforms with the IIA's Standards for the Professional Practice of Internal Auditing, departmental standards, and where applicable, AICPA and GAAS standards and guidelines.
QUALITY ASSURANCE POLICY

All working papers will be independently reviewed to ensure there is sufficient evidence to support conclusions, document the extent of audit work performed, ensure that all audit objectives have been met, as well as substantiate compliance with applicable auditing standards.
A detailed review will be conducted by the Audit Manager for assigned staff's working papers. A less comprehensive review will be conducted by audit administration or an assigned Quality Assurance staff person. EXCEPTION: If the Audit Manager is the only staff member assigned to the audit/task then the detailed review will also be performed by department administration or an assigned Quality Assurance staff person.
Initialing (Director/Quality Assurance staff person and the Audit Manager) working papers (Section Summaries, Audit Programs, Draft Report) and completing the "Quality Assurance Review form," will serve as documentation of the review process and will be filed with the working papers.

NOTE: Auditors are encouraged to perform an "informal" self-review of their working papers. However, this review would be for their own benefit only and therefore this document WILL NOT be a part of the working papers.

QUALITY ASSURANCE REVIEW PROCESS

In performing the review the reviewer should:

Review working papers from audit program steps to the referenced working papers ensuring cross-referencing is proper, the working papers support the steps performed, and all steps have been completed (or why steps were not completed).
Review working papers from the report(s) to the digest to the working paper summaries to the detailed working papers to ensure that all findings are stated, adequately document and support the OPINIONS, FINDINGS, and RECOMMENDATIONS stated in the report.
Determine working paper's compliance to general department working paper standards.
Determine report(s) compliance with general department report standards.
Determine Permanent/Continuing Audit File's compliance with department standards.
Record any deficiencies, comments, etc. on a Working Paper Review Notes form.
The auditor(s) who prepared the working papers will then respond (if necessary) to these points on the same form.
After the reviewer has "cleared" the points and completed (initialed) the "Quality Assurance Review form," the working papers will be forwarded to audit administration.
Audit administration will review the working papers and discuss the findings and review comments with the Assigned Auditor, Audit Manager, and Reviewer, then complete the relevant parts of the "Quality Assurance Review form," and approve the draft report for the exit conference.
The Report Reviewer will perform a pre-exit conference edit check for spelling, cursory grammatical, and consistency review.
The assigned auditor will forward a copy of the draft report to the auditee prior to the exit conference.
After exit conference amendments, the Report Reviewer will perform a spell check, as well as a cursory grammatical and consistency review, then print out the FINAL version of the report.
The Audit Manager, assigned Auditor(s) and Director will review and sign the final report.

NOTE: The working papers and report will be factors used in the Performance Evaluation process.

AUTHORITATIVE REFERENCE

Standards for the Professional Practice of Internal Auditing
500 Management of the Internal Auditing Department. The Director of Internal Auditing is responsible for properly managing the department...
560 Quality Assurance. The Director of Internal Auditing should establish and maintain a quality assurance program to evaluate the operations of the Internal Auditing Department. ....

GENERAL STANDARDS FOR WORKING PAPERS

1. Functions of Working Papers

Support auditor's opinion
Aid in the conduct and supervision of the engagement
Provide a record of:

procedures applied
test performed
information obtained
pertinent conclusions reached

Provide evidence that the audit was conducted in accordance with the Standards for the Professional Practice of Internal Auditing

2. Completeness of Working Papers

Working papers should be accurate and complete

no significant questions within the scope or related to the objective of the audit should go unanswered
working papers must "stand alone," in that it is clearly stated what work was performed, how and from where samples were selected, the purpose of the working papers, what findings were made, etc.

Each item in the working papers should contain:

a descriptive heading
identification of source if not obvious
the date of preparation and auditor's initials
index number of the work paper

Working papers should be sufficient, competent, relevant, and useful to provide a sound basis for audit findings and recommendations

consistent, neat, not crowded
only essential items included
arranged in a uniform style

Working papers should prove that standards have been followed such as:

adequate planning and supervision
adequate review of internal control
sufficient competent evidential matter

3. Examples of Working Papers

Working papers may include any or all of the following:

audit programs, summaries, schedules, computations, or analysis prepared or obtained
memoranda, interviews, letters of confirmation or representation
data stored on tapes, films, disk, or other media

The working papers listed below constitute the minimum REQUIRED support for an assignment

Working Papers Index
Assignment Form
Draft Report
Digest of Significant Findings
Quality Assurance Review
Audit Program
Section Summaries for each audit program section
Worksheet or Lead Schedules
Final Report

The following working papers should generally be prepared, but may not be considered mandatory for all assignments:

Permanent/Continuing Audit File
Summary of Audit Objectives and Time Control
Announcement Letter
Contact List
Auditee Financial Statements
Interim Memorandums and Meetings
Exit Conference Record

4. Cross-Referencing of Working Papers

All significant amounts and items should be cross-referenced

5. Indexing of Working Papers

Every page should have an index number
The index should be simple
The index should be capable of infinite expansion

GENERAL STANDARDS - REPORT(S)

Reports conform to the department format guidelines.
Report title specifically states what was audited.
Report is copied to right people (at a minimum this should be the Vice President in Internal Audit reporting line, and the report addressee's direct supervisor, reporting line, etc.)
Audit objectives are stated clearly and in agreement with those stated in the announcement letter or Audit Assignment form (if no announcement letter sent).
Scope clearly states what we examined including, if applicable, what period, transactions, documents, and limitations.
Opinion (where appropriate) will be supported by audit findings.
Background contains mission and other information of value to reader.
Findings are presented clearly and contain the following elements:
Statement of Condition - Should be stated in first sentence
Criteria - Policy, etc.,
Effect - potential or actual exposure to the University
Cause - how did it happen (if known)
Recommendation
Recommendations are specific enough so the auditee understands what is expected, something that can be accomplished, cost beneficial, followed-up on, etc.
Draft Report is referenced to the working papers.
Reports are objective, clear, concise, constructive, and timely.
The auditor presents to appropriate management a draft of the final report for discussion before issuance of the final report.
If appropriate, a Management Letter may be issued.

Reporting and Follow-up

The most successful audit projects are those in which the client and the Internal Audit consultants have a constructive working relationship. Our objective is to have the client's continuing involvement as well as communication at every stage, so that the client understands what we are doing and why we are doing it.
Although every audit project is unique, the audit process is similar for most engagements. The audit process normally consists of four stages: Preliminary Review, Fieldwork, Audit Report, and Follow- up Review.

AUDIT REPORT, TRANSMITTAL LETTER, AND MANAGEMENT LETTER

Our principal product is the final report in which we express our opinions about the audit findings and discuss our recommendations for improvements. Therefore, in order for Internal Audit to be effective, our reports must clearly and persuasively convey the results of our audits and convince readers to recognize the validity of the findings and the benefit of implementing any recommendations.
To facilitate communication and ensure that the recommendations presented in the final report are practical, Internal Audit discusses the rough draft with the client prior to issuing the final report.
Internal Audit prints and distributes the final report to the unit's operating management, the unit's reporting supervisor, the Vice President for Administration and other appropriate members of senior University management. This report is primarily for internal University management use. The Internal Audit Director's approval is required for release outside of the University. The results of the audit are also included in Internal Audit's annual report to the Board of Trustees.
The first page (transmittal letter) of the report is a letter requesting the client's written response to the report recommendations within 30 days. The client should explain, in the written response, when and how report findings will be resolved with an implementation timetable. We encourage the client to copy this response to all recipients of the final report. The client's response is included in Internal Audit's annual report to the Board of Trustees.
A management letter written to and distributed to only the unit manager may be issued. This letter will contain suggestions for improving controls, operations, and anything audit administration feels needs to be in writing.

CONFIDENTIALITY - REPORTS

Rationale:

Although Internal Audit reports are internal documents exclusively for the use of University administration, certain reports will contain information that SHOULD NOT BE DISCLOSED OUTSIDE OF THE AREAS RECEIVING THE REPORT.

Policy:

Audit reports will be classified as CONFIDENTIAL if they meet the following criteria:

Report discloses a weakness (potentially resulting in a loss) which has not been corrected at the time of distribution
Report discloses sensitive information which could prove an embarrassment to the University (if made public)
Report discloses information classified as "restricted data"
At the discretion of the Director of Internal Audit

Audit reports classified as CONFIDENTIAL will contain the words CONFIDENTIAL REPORT on the title page and the footnote "Confidential - Do not disclose information in this document." on each page.

Process:

The Audit Manager will discuss their recommendation and rationale regarding the classification of a report when it is given to the Director of Internal Audit for initial review.

EXIT CONFERENCE

After the draft report has been approved by Internal Audit administration, the auditor(s) meet with the unit's management team to discuss the findings, recommendations, and text of the draft. At this time, the client comments on the draft report, and any inaccuracies or impractical recommendations resolved to the extent possible.
Pre-exit conference items:

There should be no surprises - everything in the draft should have been discussed during the fieldwork.
Be sure you can easily find supporting documentation for findings in the working papers in case questions arise at the exit conference.
Try to anticipate potential questions/conflicts

Exit conference agenda:
Go through verbal recommendations:
Discuss the following and go through report and management letter:

Do they want to respond after receiving the final report or would they like their response either included or attached to the final report (department preference is to include or attach the audit response with the final report)?
A follow-up will be done within one year to review action taken.
Results of audit, response, and follow-up will be included in our annual report to the Board of Trustees.
Where there any questions about the scope and objectives?
Are there any questions about the opinion?
Are there any questions, comments, additions, or deletions on background?
Any comments or questions about other sections (go through each)?
General comments about audit process?

CLOSING OF THE AUDIT

The auditor then prepares a draft, taking into account any revisions resulting from the exit conference and other discussions. When the changes have been reviewed by audit administration and the client, the final report is issued.
The report is then printed in final by the report reviewer and distributed to the unit's reporting supervisor, the Vice President for Administration, and other appropriate members of senior University management. This report is primarily for internal University management use. The Internal Audit Director's approval is required for release outside of the University.

INPUT IN BOARD OF TRUSTEE REPORT

The establishment of a clear reporting structure with the Board of Trustees enhances Internal Audit's independence and strengthens our ability to function freely within the University. It also provides us the opportunity to acquaint the Board with any critical audit findings or issues, our assessments of operations during the past year, and our concerns, goals and plans for the next fiscal year.
The results of all report findings and recommendations, the response from the auditee, and the follow- up will be reported in an annual report to the Board of Trustees.

AUDIT FEEDBACK QUESTIONNAIRE

Purpose:

To continuously improve the quality of service to our customers/clients by requesting and reviewing their feedback of the level of satisfaction with our audit work.

Process:

An audit feedback questionnaire will be sent to the auditee immediately after an audit report (excluding cash count and follow-up reports) has been issued either a paper copy or electronically at http://www.indiana.edu/~iuaudit/form s/feedback.html. Returned questionnaires will be recorded and summarized.

FOLLOW-UP REVIEW

Within one year of the final report, Internal Audit will perform a follow-up review with client management to ascertain the resolution of the report findings.
The actions taken to resolve the findings are reviewed and may be tested to ensure that the desired results were achieved. In some cases, managers may choose not to implement an audit recommendation and to accept the risks associated with an audit finding--the follow-up review will note this as an unresolved finding.
The follow-up report will list the actions taken by the client to resolve the original report findings. Unresolved findings will also appear in the report and will include a brief description of the finding, audit recommendation, client response, current condition, and the continued exposure to the University. In addition to the original report recipients and other officials as deemed appropriate, the follow-up review results will also be included in the Internal Audit Annual Report to the Board of Trustees.

Personnel

Job Descriptions

DIRECTOR

Reports To: Board of Trustees, Vice President for Administration Department/Campus: Internal Audit/BL
SUMMARY:

Direct and coordinate internal auditing within the University as an independent appraisal of the various operations and systems of control to determine if acceptable policies and procedures are followed, established standards met, resources are used efficiently and economically, planned missions are accomplished effectively and the organization's objectives are being achieved.

DUTIES AND RESPONSIBILITIES:

Supervise and coordinate internal audit programs of the University accounting and financial operations to include the review of accounting procedures, confirmation of accounts, inspection of physical operations, and investigations of irregularities and errors.
Supervise examination and analysis of records to insure the effectiveness of accounting and managerial controls at reasonable cost, accuracy of transactions, and compliance with applicable laws and established University policies and procedures.
Direct and coordinate analysis of operating departments and functions and make recommendations to promote maximum managerial effectiveness and operational efficiency when appropriate.
Ascertain the extent to which the University assets are accounted for and safeguarded from losses.
Counsel and guide auditors to ensure that approved audit objectives are met and practical coverage is achieved.
Identify those activities subject to audit coverage, evaluating their significance and assessing the degree of risk inherent in the activity in terms of cost, schedule, and quality.
Monitor work performance for accuracy and completeness to ensure compliance with established departmental objectives.
Supervise audit participation and participate in systems and procedures development and testing.
Supervise review of procedures and records for their adequacy to accomplish intended objectives, appraising policies, and plans relating to the activity of function.
Train and instruct supportive staff.
Review and ascertain the reliability of management data developed within the organization. Recommend and develop internal auditing policies, standards of performance, procedures, and programs.
Authorize the publication of reports on the results of audit examinations, including recommendations for improvements.
Serve in advisory capacity for University officials. Make recommendations for improved fiscal management systems.
Appraise the adequacy of corrective action taken by operating management and prepare a variety of related reports and analysis.
Serve as liaison with many departments and offices to assist with problems and determine need for audits.
Contact with students, staff, faculty, outside businesses, and agencies regarding University audit related or business problems.
Coordinate audits with State Board of Accounts, Department of Health Education and Welfare, Higher Education Commission, and others.
Provide executive management with annual reports on the results of audit activities.
Direct various personnel functions including, but not limited to hiring, merit recommendations, promotions, transfers, vacation schedules, and dismissals.
Determine fiscal requirements of internal auditing operations and prepare budgetary operations. Monitor, verify, and reconcile expenditure of budgeted funds.
Perform special reviews as requested by the Vice President for Administration.
Review University policy and structural changes that might alter audits and coverage.
Serve on various University committees.
Serve on State Audit Committee set up by Higher Education Commission to perform audits and reviews at other State Institutions.
Represent the University at professional organizations, associations, and committees.
Perform other duties incidental to the work described herein.

ASSOCIATE DIRECTOR

Reports To: Internal Audit Director Department/Campus: Internal Audit/IUPUI
SUMMARY:

Provide administrative and supervisory support to the Director for the coordination and administration of system-wide audits, the planning and development of department operations, and the supervision of department staff.

DUTIES AND RESPONSIBILITIES:

Supervise professional staff by evaluating performance, hiring, and terminating when necessary.
Review audits to ensure that they are conducted according to audit standards, sufficient evidence is obtained, and that procedures are properly documented to support audit findings.
Plan and prepare formal written reports addressed to department administrators or external agencies.
Attend entrance and exit conferences for audits in the absence of the Director.
Appraise the adequacy of departmental replies to audit reports.
Manage day-to-day office operations such as ensuring audits are on schedule, weekly time reports are submitted, and assignment forms are issued.
Assist the Director in developing and implementing new and revised department policies and procedures necessary for providing internal auditing services to all campuses within the University system. Determine the direction and extent of audits.
Serve as department head in the absence of the Director and assist the Director with budget planning.
Recommend to University Administration control issues that should be addressed with University Institutional policies.
Design technically complex audit programs for specialized computer software to retrieve information from University computer systems.
Maintain an effective liaison with University administrators at all campuses and governmental auditors to coordinate audits of University records.
Certify financial reports at the request of external agencies.
Serve on various University committees in an advisory capacity.
Assist the Director in developing an audit plan that provides for the effective audit coverage of the University systems based on an assessment of potential risk and exposure to the University.
Survey functions and activities of units to evaluate nature of operations and existence and adequacy of internal controls.
Provide guidance, training, and assistance to auditors. Continue to develop expertise in specialized areas to advise other auditors or University units.
Maintain knowledge of current accounting and auditing practices through continuing professional education.
Perform other related duties incidental to the work described herein.

INFORMATION SYSTEMS AUDIT MANAGER

Reports To: Internal Audit Director Department/Campus: Internal Audit/BL
SUMMARY:

Using specialized knowledge of accounting, auditing, and electronic data processing (EDP) to perform audits of adequacy of internal controls and the accuracy of institutional data in the University's data processing areas. Attest to the accuracy, effectiveness, and efficiency of the University's information (EDP-based) systems. Determine level of compliance with institutional policies and procedures, state and federal laws, and contractual obligations regarding privacy and security in data processing areas. Provide support to staff internal auditors in the development of computer-assisted audit techniques.
Requirements needed for this position are a minimum of an undergraduate degree in accounting, business administration, finance or computer science, and a certificate or licensing for CPA and/or CISA. Four years experience as an EDP auditor, two years experience as a financial auditor, and knowledge of computer environment similar to the one at Indiana University.

DUTIES AND RESPONSIBILITIES:

Participate in the development of new University system applications to:

Ensure that adequate controls are established and installed to meet management objectives,
Verify that users and computer operation's staff have been trained in the system functions and controls
Determine whether level of security is appropriate
Verify that backup and recovery procedures are complete

Perform audits of existing financial, student, and security applications, the related network links and the supporting computer data centers.

Based on a review and evaluation of current internal controls, assess potential risk, and exposure to the University, and prepare detailed audit program describing tests to be performed.
Obtain sufficient competent and relevant evidential matter, analyze and summarize data to support an objective informed opinion on the adequacy and effectiveness of internal controls, the accuracy of institutional data, and the level of compliance with University policies.
Draft written reports expressing opinions on the adequacy and effectiveness of system controls, the accuracy of institutional data, and the level of compliance with relevant policies, procedures, and government statutes. Recommend changes in policies and procedures to enhance controls or correct deficiencies.

Appraise the adequacy of departmental replies to final audit reports and perform post-audit reviews to determine the extent to which audit recommendations have been implemented.
Assign work and supervise EDP audit staff (proposed position) so that the audit is conducted in a professional manner and the audit objectives are accomplished. Review working papers and conduct performance appraisals so that standards are complied with and evaluations can be accurately completed.
Serve on various University committees addressing such items as data access, computer and network security, system design, etc.
Provide guidance, training, and assistance to staff auditors in using computerized audit techniques, maintaining library of standard audit programs, administering department's computer network, etc.
Stay current with technical changes in auditing, data processing, accounting, University policies, and government regulations so that audits are conducted professionally and in accordance with department standards.
Develop an EDP audit plan that provides for the effective audit coverage of the University's EDP application systems based on an assessment of potential risk and exposure to the University.

Audit Manager - Northwest, South Bend, and Kokomo Campuses

Reports To: Internal Audit Director / Associate Director Department/Campus: Internal Audit/IUPUI and BL
SUMMARY:

Using specialized knowledge of accounting, auditing, and electronic data processing, plan and conduct complex and technical financial and managerial audits of University operations on the Northwest, South Bend, and Kokomo Campuses. Analyze evidential data as a basis for an informed, objective opinion. Prepare comprehensive reports addressed to campus and University administration and external agencies.

DUTIES AND RESPONSIBILITIES:

Plan and perform complex, technical financial and managerial audits of University operations on the Northwest, South Bend, and Kokomo Campuses in accordance with accepted professional standards. Determine whether areas reviewed are performing their planning, accounting, custodial, and control activities in compliance with managerial guidelines, applicable statements of policy and procedures, and in a manner consistent with both University objectives and high standards of administrative practice. Obtain and analyze data to provide an objective, informed opinion on the accuracy and fairness of financial statements. This includes performing advanced and complex analytical procedures and recommending material adjustments (i.e., to University financial statements).
Develop an audit plan that provides for the effective audit coverage of the University operations on the Northwest, South Bend, and Kokomo Campuses based on an assessment of potential risk and exposure. Survey functions and activities of units to evaluate nature of operations and existence and adequacy of internal controls.
Perform audits of University operations on the Northwest, South Bend, and Kokomo Campuses to ensure effectiveness of accounting and managerial controls and accuracy of recorded data, promote efficiency, safeguard University assets, and monitor compliance with applicable laws and University policies and procedures.
Supervise and direct staff assigned to assist on campus audits. Monitor performance of staff and evaluate performance of supervised staff.
Exercise professional judgment to determine materiality of findings and adequacy and effectiveness of the operation.
Conduct special reviews requested by campus administration. Arrive at independent decisions concerning recommendations for campus administration.
Maintain an effective liaison with campus administrators and governmental auditors to coordinate audits of University records.
Determine the direction and extent of assigned audits. Prepare the program and establish procedures, which may include statistical sampling and electronic data processing. Prepare and evaluate working papers supporting opinions presented in the report to administration and external agencies.
Appraise the adequacy of departmental replies to audit reports and perform post-audit reviews to determine the extent to which audit recommendations have been implemented.
Establish audit procedures involving statistical sampling and electronic data processing. Use specialized knowledge to retrieve information from the University mainframe computer.
Discuss deficiencies and recommend corrective actions to improve operations and reduce costs. Plan and prepare formal written reports addressed to department administrators or external agencies.
Continue to develop expertise in specialized areas to advise other auditors or University units.
Review and evaluate the adequacy of the overall accounting and non-accounting controls of computerized information systems residing on departmental computers. This requires a general understanding of departmental activities in relation to computerized information systems under review.
Perform general administrative tasks including those assigned by the Director.
Maintain knowledge of current accounting and auditing practices through continuing professional education.

AUDIT MANAGER

Reports To: Internal Audit Director Department/Campus: Internal Audit/IUPUI and BL
SUMMARY:

Using specialized knowledge of accounting, auditing, and electronic data processing, conduct and supervise staff in complex and technical financial and managerial audits of University operations on seven campuses. Evaluate performance of supervised staff. Analyze evidential data as a basis for an informed, objective opinion. Prepare comprehensive reports addressed to University administration and external agencies.

DUTIES AND RESPONSIBILITIES:

Perform complex, technical, financial, and managerial audits of University operations in accordance with accepted professional standards. Determine whether areas reviewed are performing their planning, accounting, custodial, and control activities in compliance with managerial guidelines, applicable statements of policy and procedures, and in a manner consistent with both University objectives and high standards of administrative practice. Obtain and analyze data to provide an objective, informed opinion on the accuracy and fairness of financial statements. This includes performing advanced and complex analytical procedures and recommending material adjustments (i.e., to University financial statements).
Supervise, coordinate, and participate in audits of University systems to ensure effectiveness of accounting and managerial controls and accuracy of recorded data, promote efficiency, safeguard University assets, and monitor compliance with applicable laws and University policies and procedures.
Exercise professional judgement to determine materiality of findings and adequacy and effectiveness of the operation.
Conduct special reviews requested by central administration. Arrive at independent decisions concerning recommendations for University administration.
Maintain an effective liaison with University administrators and governmental auditors to coordinate audits of University records. Certify financial reports at the request of external agencies. Serve on various University committees in an advisory capacity.
Monitor performance of staff and evaluate performance of supervised staff. Direct staff and, when applicable, the activities of assistants. Participate in the training of staff.
Assist in developing an audit plan that provides for the effective audit coverage of the University systems based on an assessment of potential risk and exposure to the University. Survey functions and activities of units to evaluate nature of operations and existence and adequacy of internal controls.
Determine the direction and extent of assigned audits. Prepare the program and establish procedures which may include statistical sampling and electronic data processing. Prepare and evaluate working papers supporting opinions presented in the report to administration and external agencies.
Appraise the adequacy of departmental replies to audit reports and perform post-audit reviews to determine the extent to which audit recommendations have been implemented.
Establish audit procedures involving statistical sampling and electronic data processing. Use specialized knowledge to retrieve information from the University mainframe computer.
Discuss deficiencies and recommend corrective actions to improve operations and reduce costs. Plan and prepare formal written reports addressed to department administrators or external agencies.
Provide guidance, training, and assistance to staff auditors. Continue to develop expertise in specialized areas to advise other auditors or University units.
Review and evaluate the adequacy of the overall accounting and non-accounting controls of computerized information systems residing on departmental computers. This requires a general understanding of departmental activities in relation to computerized information systems under review.
Perform general administrative tasks including those assigned by the Director.
Maintain knowledge of current accounting and auditing practices through continuing professional education.

INFORMATION SYSTEMS AUDITOR

Reports To: Information Systems Audit Manager Department/Campus: Internal Audit/BL
SUMMARY: Using specialized knowledge of auditing and information technology, participate in audits of the University's information systems, systems development processes, LANs, and related resources/processes to determine the adequacy of general and application controls and to assess compliance with applicable policies, procedures, statutes, and contract requirements. This entails analyzing evidential data as a basis for an informed, objective opinion and preparing comprehensive reports addressed to University administration.
DUTIES AND RESPONSIBILITIES: With guidance from the Information Systems Audit Manager, plan and conduct audits in accordance with applicable professional and office standards.

Exercise professional judgment to determine adequacy of controls, materiality of findings, and sufficiency of evidence to support opinions and findings presented in audit reports. Prepare working papers containing sufficient, competent, and relevant evidence to support findings and opinions in audit reports. Draft audit reports containing the results of the audit, including findings, recommendations, opinions.
Assist financial and operational auditors in applying information systems audit principles and concepts, identifying the relevant automated controls to include in the audit scope, designing audit programs/procedures to assess their adequacy, and documenting the impact of strengths or weaknesses to current audit procedures/objectives. Perform post-audit reviews to determine the extent to which audit recommendations have been implemented. Appraise the adequacy of departmental replies to final audit reports, and perform post-audit reviews to determine the extent to which audit recommendations have been implemented.
Discuss deficiencies with management and recommend actions to improve controls, enhance information integrity, streamline processes, and reduce costs. Where appropriate, recommend changes in policies and procedures to enhance controls or correct deficiencies.
Write/develop computer assisted audit techniques (CAATs) to extract and manipulate data from complex computer systems and to facilitate audit compliance and substantive testing procedures.
Assist in administering and supporting the Internal Audit Local Area Network (LAN).
Maintain knowledge of current auditing, data processing, and accounting practices and University policies and government regulations. Provide in-house information systems audit and technical training for internal audit staff.
Perform other duties as assigned.

QUALIFICATIONS:

Required Degree in business, accounting, or information systems discipline or equivalent combination of education and experience. One year of related work experience in information systems auditing or related field (e.g., information systems analysis, or development). Excellent planning, organization, research, analysis, writing, and interpersonal skills.
Ability to communicate effectively with individuals and groups at all organizational levels.
Able to work in a team-oriented environment.
Preferred: Certification preferred. (e.g., CISA, CDP, CPA, CIA)
Proficient in providing mainframe and PC support to internal audit staff using computerized audit tools to retrieve and analyze data stored on mainframe and departmental systems.
Familiar with diverse computing environments and architecture, including mainframe, client-server, network, and personal computers.
Familiar with operations, policies, and procedures in a university environment.

AUDITOR

Reports To: Internal Audit Director Department/Campus: Internal Audit/BL and IUPUI
SUMMARY:

Provide assistance to the audit manager in performing financial and managerial audits of general University operations on seven campuses. The duties include analyzing evidential data as a basis for an informed, objective opinion and preparing comprehensive reports addressed to University administration and/or external agencies.

DUTIES AND RESPONSIBILITIES:

Participate in performing financial and managerial audits of general University operations in accordance with accepted professional standards.
Aid the audit manager in determining whether areas reviewed are performing their planning, accounting, custodial, and control activities in compliance with managerial guidelines and applicable statements of policy and procedures, and in a manner consistent with both University objectives and high standards of administrative practice.
Obtain and analyze data to provide an objective, informed opinion on the accuracy and fairness of financial statements. This includes performing analytical procedures and recommending adjustments to University financial statements.
With guidance from the audit manager, determine the direction and extent of assigned audits. Prepare the program and establish procedures which may include statistical sampling and electronic data processing. Prepare working papers supporting opinions presented in the report to administration and external agencies.
Participate in audits of University systems to ensure effectiveness of accounting and managerial controls and accuracy of recorded data, promote efficiency, safeguard University assets, and monitor compliance with applicable laws and University policies and procedures.
Exercise professional judgement to determine materiality of findings and adequacy and effectiveness of the operation.
Assist in the review and evaluation of the overall accounting and non-accounting controls of computerized information systems residing on departmental computers. This requires a conceptual understanding of the departmental activities in relation to computerized information systems under review.
Discuss deficiencies and recommend corrective actions to improve operations and reduce costs. Plan and prepare formal written reports addressed to department administrators or external agencies.
Perform post-audit reviews to determine the extent to which audit recommendations have been implemented.
Assist in the performance of special reviews requested by administration.
Maintain knowledge of current accounting and auditing practices through continuing professional education.
Perform other related duties incidental to the work described herein.

Performance Evaluation

PERFORMANCE EVALUATION RATIONALE, POLICY AND PROCESS

Rationale:

Performance evaluation will serve two major functions in our department. First, it will be used for employee development. The feedback that staff receive from the appraisal process should provide them with information they can use to improve job performance. Second, performance appraisal provides bottom-line evaluations of employees that can be used for administrative decisions such as promotion, salary evaluation, recommendation for training, or remedial action.

Performance Evaluation Policy:

All Internal Audit full-time appointed employees will have an evaluation of their work performance at least every quarter and once a fiscal year. The results of these evaluations will be the primary means for administrative decisions.

Performance Evaluation Process:

The evaluation process will be a twofold approach (quarterly evaluation and annual evaluation). Quarterly evaluations will cover July through September, October through December, January through March, and April through June. These evaluations will be performed in October, January, April, and July, respectively. An annual appraisal will be completed by department administration each April.

Specific factors that will be considered in the annual Performance Evaluation will include:

ELEMENT: Audits

Total Chargeable Hours at department standard
Audit Completed Timely
Audit Within Budget hours
Workpapers Technically Correct (Dept Standards)
Audits Performed according to standards
Hours at Auditee Location

ELEMENT: Job Knowledge

Competent in required job skills and knowledge
Exhibits ability to learn and apply new skills
Exhibits sound and accurate judgment
Requires minimal supervision
Displays understanding of how job relates to others

ELEMENT: Professional Development

Keeps current on University Policies and Processes
Keeps current on University systems
Participates in available Continuing Education
Certified as CIA, CPA, CISA, CFE
Keeps current with Accounting and Auditing trends

ELEMENT: Teamwork

Balances team and individual responsibilities
Exhibits objectivity and openness to others' views
Gives and welcomes feedback
Contributes to building a positive team spirit
Puts success of team above own interests

ELEMENT: Written Communications

Writes clearly, precisely and informatively
Edits work for spelling, grammar, and format
Varies writing style to meet needs
Follows standards for presenting elements of findings
Scope, Objective and Opinion consistent w/ work done
Selects and uses appropriate communication methods

ELEMENT: Oral Communications

Speaks clearly and persuasively
Listens and gets clarification
Responds well to questions
Demonstrates group presentation skills
Participates in meetings
Keeps others adequately informed

ELEMENT: Innovation

Displays original thinking and creativity
Meets challenges with resourcefulness
Generates suggestions for improving work
Develops innovative approaches and ideas

General comments could be made in the following areas:
ELEMENT: Adaptability

Adapts to changes in the work environment
Manages competing demands
Accepts criticism and feedback
Changes approach or method to best fit the situation

ELEMENT: Analytical Skills

Synthesizes complex or diverse information
Collects and researches data
Uses intuition and experience to complement data
Identifies data relationships and dependencies
Designs work flows and procedures

ELEMENT: Attendance & Punctuality

Schedules time off in advance
Begins working on time
Keeps absences within guidelines
Ensures work responsibilities are covered when absent
Arrives at meetings and appointments on time

ELEMENT: Cooperation

Establishes and maintains effective relations
Exhibits tact and consideration
Displays positive outlook and pleasant manner
Offers assistance and support to co-workers
Works cooperatively in group situations
Works actively to resolve conflicts

ELEMENT: Cost Consciousness

Works within approved budget
Conserves organizational resources
Develops and implements cost saving measures
Contributes to profits and revenue

ELEMENT: Customer Service

Displays courtesy and sensitivity
Manages difficult or emotional customer situations
Meets commitments
Responds promptly to customer needs
Solicits customer feedback to improve service

ELEMENT: Dependability

Responds to requests for service and assistance
Follows instructions
Responds to management direction
Takes responsibility for own actions
Commits to doing the best job possible
Keeps commitments
Meets attendance and punctuality guidelines

ELEMENT: Initiative

Volunteers readily
Undertakes self-development activities
Seeks increased responsibilities
Takes independent actions and calculated risks
Looks for and takes advantage of opportunities
Asks for help when needed

ELEMENT: Judgment

Displays willingness to make decisions
Includes appropriate people in decision making process
Makes timely decisions

ELEMENT: Leadership

Exhibits confidence in self and others
Inspires respect and trust
Reacts well under pressure
Shows courage to take action
Motivates others to perform well

ELEMENT: Managing People

Provides direction and gains compliance
Includes subordinates in planning
Takes responsibility for subordinates' activities
Makes self available to subordinates
Provides regular performance feedback
Develops subordinates' skills and encourages growth

ELEMENT: Organization Support

Follows policies and procedures
Completes administrative tasks correctly and on time
Supports organization's goals and values
Benefits organization through outside activities
Supports affirmative action and respects diversity

ELEMENT: Personal Appearance

Dresses appropriately for position
Keeps self well-groomed

ELEMENT: Planning & Organization

Priorities and plans work activities
Uses time efficiently
Plans for additional resources
Integrates changes smoothly
Sets goals and objectives
Works in an organized manner

ELEMENT: Problem Solving

Identifies problems in a timely manner
Gathers and analyzes information skillfully
Develops alternative solutions
Resolves problems in early stages
Works well in group problem solving situations

ELEMENT: Project Management

Develops project plans
Coordinates projects
Communicates changes and progress
Completes projects on time and budget
Manages project team activities

ELEMENT: Quality

Demonstrates accuracy and thoroughness
Displays commitment to excellence
Looks for ways to improve and promote quality
Applies feedback to improve performance
Monitors own work to ensure quality

ELEMENT: Quantity

Meets productivity standards
Completes work in timely manner
Strives to increase productivity
Works quickly
Achieves established goals

ELEMENT: Safety & Security

Observes safety and security procedures
Determines appropriate action beyond guidelines
Uses equipment and materials properly
Reports potentially unsafe conditions

ELEMENT: Sales Skills

Achieves sales goals
Overcomes objections with persuasion and persistence
Initiates new contacts
Maintains customer satisfaction
Maintains records and promptly submits information

AUTHORITATIVE REFERENCE:

Standards for the Professional Practice of Internal Auditing

500 Management of the Internal Auditing Department. The Director of Internal Auditing should properly manage the Internal Auditing Department.
540 Personnel Management and Development. The Director of Internal Auditing should establish a program for selecting and developing the human resources of the Internal Auditing Department.

Training and Professional Development

CERTIFICATION PROGRAMS

One aspect of professional development is obtaining professional certification as a Certified Public Accountant, Certified Internal Auditor, Certified Information Systems Auditor, or Certified Fraud Examiner. To increase the professionalism and credibility of the audit staff, the department supports employees' efforts in achieving certification through obtaining study aids and providing reimbursement for sitting for exams. Support is also given by making study time available during working hours and allowing time off to sit for exams. Professional certification is a factor used in the department's annual employee performance appraisal.
Professional development through certification, membership, and participation in professional organizations is encouraged. Internal Audit Department funds may be available and budgeted to support this activity.

REQUEST FOR FUNDS FOR CONTINUING EDUCATION

Rationale:

Internal Audit has a responsibility to provide for the most effective use of available continuing education funds in supporting staff member requests for professional training.

Policy:

When requesting continuing education funds in excess of $100, a completed REQUEST FOR FUNDS FOR CONTINUING EDUCATION form found (INTERNAL USE ONLY) at http://www.indiana.edu/~iuaudit/internal/training.html must be submitted to and approved by the Internal Audit Director. Approvals for seminars that will have a total expenditure of less than $100 will be done informally by the director.

Process:

Auditors should review seminar material.
Staff members who desire to attend a particular seminar should (if total expenditures will exceed $100) complete the above mentioned form. (Requests to attend seminars that will cost less than $100 can be communicated informally to the Director.)
The Director will make the decision for the expenditure based on availability of funds and the staff members current professional development responsibilities and requirements in maintaining their technical competence and proficiency.

Department Administrative Procedures

Management of Audit Hour Resources

The principal resource that Internal Audit has to accomplish its mission is the amount of available staff hours. Therefore, it is paramount that we have a process that will provide the information necessary to effectively manage this resource.

AUDIT RESOURCE REPORTING POLICIES

All professional training requires prior approval of the Internal Audit Director.
The departmental standard for staff hours is expected to charge to projects each year is 1,500 hours.
Auditors will perform fieldwork at the auditee location whenever possible.
All staff members will submit a weekly progress report, using the electronic Audit Reporting and Management System (ARMS) detailing the hours spent on assigned projects. The MISCELLANEOUS UNBUDGETED TASK #94879 will be used to list duties that you performed that were not budgeted and MISCELLANEOUS UNBUDGETED TASK #94878 for days that you were not in the office because of paid time off or sick time. Progress reports must be completed by Friday 6:00 p.m.
Projects will be reported in half-hour increments using the project control numbers assigned by the director. The comments field will be used to provide a brief description of the work performed or if no work was performed an explanation of why. The comments field should also include a statement of how many hours were spent performing field work at the auditee location
Any audit work or other activity that is material (e.g., expected to accumulate more than 8 hours or for which a written report/memo will be issued) will be assigned a project control number.

Standard Electronic Tools

DEPARTMENT (FOCUS) QUERIES

To establish a library (USER ID UIA1) of standard 'off the shelf' FOCUS queries. These queries will be written so that they can be easily executed, by changing well-defined parameters, or simply modified to OUTPUT data in a different format.

The library will be controlled by the department FOCUS LIBRARIAN who will be responsible for updating the library and informing staff of the current library's contents.
Queries will be written by staff members who have developed an appropriate understanding of the structure and the data in the accessed files.
Queries will be written according to standards established by the department.
Queries will be thoroughly reviewed and tested before being placed in the library by the librarian.
Whenever practical these queries will be used to extract data from FOCUS defined files for use in audit testing.

ELECTRONIC WORKING PAPERS

To assure standardization of working papers and reports standardized reports, programs, and working papers have been developed as Word templates. In addition, there is an Audit Macros toolbar that will enable you to input your information in a form that will automatically add the information to the new Word document.

Miscellaneous Policies

PURGING WORKING PAPERS

Working papers will be retained for five years after the date of the report. The working papers will be purged once a year after the Directors' approval. The exception to this policy is when we are required to retain working papers longer by law or by agreement.

FLEXIBLE WORK HOURS

The department has adopted a flexible work schedule. Each person should notify the Director of his/her "normal" work hours (i.e., 7:30 to 4:30, 8 to 5 etc.). If you are going to be more than an hour later than your normal start time, you are to call someone (preferably the secretary or director) in the office so that they can send an email to the staff (you may send the email yourself if you have the capability).

PAID TIME OFF

Whenever possible, paid time off (PTO) should be requested and scheduled in advance. When requesting paid time off, use your Outlook � calendar to schedule a meeting (your calendar and the PTO calendar as Required Attendees and the Director as an Optional Attendee) for the days that you are requesting PTO. The group message should have the following characteristics.

Message: PTO - USERID (i.e., PTO - TERADKE) or (SICK, CH for campus holiday, FM for family leave, etc.)
Date: The day(s) you are requesting off. If you are scheduling more than one day, use the Start time for the first day you will be off work and the End Time for the last day you will be off work.
Time: All Day Event X'ed
Attendee List: The PTO calendar, you, and the Director (teradke)

The Director will positively confirm your request by accepting the meeting and the Administrative Assistant will accept for the PTO calendar. Each auditor will maintain the 'Blue Card' record of their paid time off. At the end of each calendar quarter Auditors will give the Administrative Assistant a copy of the 'Blue Card' record for reconciliation.
If you are SICK you should call or e-mail the Director (Bloomington) or the secretary as soon as you can.

COMPUTER SOFTWARE

Only computer software that the department or University owns rights to should be located on department computers. If you wish to install other software on a department computer, you must receive prior approval from the Director and provide evidence that you own the rights to the software.

HOUSEKEEPING

Good housekeeping bears a direct relationship to orderly and efficient work habits. When out of the office, material in work areas should be straightened. Care is to be exercised to avoid exposure of confidential or potentially sensitive documents.

OUTLOOK�

The computer application Outlook is used to schedule meeting, organize to-do lists, send e-mail, maintain your calendar, etc. So that we can get the most effective use out of this program it is imperative that you keep your schedule up-to-date with planned meetings, times you know you'll be out of the office, planned PTO, etc. In addition, you use Outlook to schedule the conference room.

On your Outlook Bar, right mouse click on Calendar and select Properties and go to the Permissions Tab
The default should be Reviewer with the ability to Create Items, Read Items, and Edit: Own so that anyone currently using Outlook in the University will be able to tell if you are available for meetings, etc.
After you set the default, add Internal Audit staff as Authors and the Director and Secretary should be set up as Editors so that they can easily work with departmental calendars.