Internal auditing

• July/August: Annual planning cycle commences

• October: Draft Annual Internal Audit Plan endorsed by the University Senior Executive Team 

• November: Annual Internal Audit Plan approved at the Senate Risk and Audit Committee (SRAC)

• December/January: The approved plan communicated to the relevant responsible areas in preparation for scheduling and commencement of the audits in the new year.

• Commences up to 4 weeks before individual audit start date
• Pre-planning audit email sent to Audit Owner to seek key documents and identify key stakeholders
• Key planning and audit meetings booked (including entry meeting)

• Commences on scheduled audit start date
• Key planning meetings with stakeholders, information gathering and early analysis and risk assessment
• Engagement terms of reference drafted
• Entry meeting held with key audit stakeholders
• Engagement terms of reference agreed with Audit Owner
• Engagement terms of reference issued to Audit Owner/Audit Sponsor

• Internal Audit evaluates existing processes and controls within the audit scope, and tests to assess the degree to which they are designed appropriately and/or operating effectively
• Assesses whether the processes in place are efficient and compliant with relevant standards and policies
• Initial issues identified, documented and discussed with all relevant responsible managers before formal exit meeting
• Quality review of audit work by Internal Audit management

• Drafting of report by lead auditor and review of draft by Internal Audit management
• Exit meeting held with Audit Owner and relevant staff 
• Draft report updated as necessary with management feedback, actions and agreed due dates
• Updated final draft report re-issued to Audit Owner
• Confirmation of final draft by Audit Owner or Audit Sponsor
• Final report issued by Internal Audit

• Audit satisfaction survey issued by lead auditor to key audit stakeholders
• Report findings and actions recorded in GRC system by lead auditor and tracking commenced
• Audit results and key findings included in quarterly reporting to the University Senior Executive Team and the Senate Risk and Audit Committee (SRAC)

• Action owners (and Action Proxies) have real-time access to the GRC system and are expected to provide ongoing updates regarding progress, including updating completion percentages, for open actions.
• Action Owners (and Action Proxies) are notified as agreed audit actions reach their due dates or are overdue.
• Action owners (and Action Proxies) provide updates on progress in the GRC system and update due dates if actions become overdue but are not yet complete.
• Upon completion, actions are closed in the GRC system and tracking ceases.
• Internal Audit has developed a procedure to manage the closure of open management actions (PDF, 342 KB)
• Overdue actions are reported to management, the University Senior Executive Team and the Senate Risk and Audit Committee (SRAC).

At an early stage, issues identified during the audit will be socialised and discussed with the responsible local members of management. This helps us to check the factual accuracy of our preliminary findings.

The lead auditor will then draft a report for review by Internal Audit management, before discussing it with the Audit Owner and appropriate members of management at the exit meeting. The report will include:

• a description of the audit approach and scope
• conclusions on the findings identified
• an overall rating
• Internal Audit recommendations
• responses by management, including agreed actions and their due dates.

There should be no surprises in the final report, as the issues addressed should have already been discussed with management.

All reports issued by Internal Audit are addressed to the organisational unit head, process owner or project sponsor. The report will also be copied to an approved distribution list, including members of the University Senior Executive Team as appropriate. 

Responding to the report

Often it's useful to take a collaborative approach to establish the actions required to address the report findings, and we encourage open discussion, debate and joint solution-seeking.

The audit recommendations are intended as a guide for management only. Agreed actions may be different to the recommendations.

When considering management’s response to the audit report, we would recommend the following approach and/or considerations:

1. Make sure that the findings are factually accurate and raise any inaccuracies with the lead auditor to resolve.
2. Be comfortable with the findings raised – that they are genuine risks which are not mitigated by any other controls, and that their risk ratings are accurate. Internal Audit is open to transparent and robust discussions to ensure the best possible outcome and accuracy of the final report.
3. When Internal Audit recommends an action you may:
   • accept that recommendation and document your response, action owner and due date
   • choose an alternative action which appropriately addresses the risk raised, or
   • choose no action and to accept the risk. This will be recorded in our system and if we consider this to be a higher risk, we may need to obtain endorsement from the University Senior Executive Team or the Senate Risk and Audit Committee (SRAC).

Assurance vs. Advisory engagements

Our process and reporting differs, depending on the nature of the work that we are undertaking: