Role of Internal Audit

Internal Audit at Columbia is a function that reports to the Executive Vice President for Finance.  Through our audit process we report our observations, findings, and recommendations in writing to the area’s operating and senior management, as well as other administrative areas that might be impacted.  The final report, which includes your comments and action plans, is distributed to the Executive VP for Finance, the Senior Executive VP for Finance, the Provost, the President, and the Independent Auditor and other management as appropriate. On occasion, the report may also be distributed to the Audit Committee.

Our approach is participatory.  We ask and expect management to participate with us in the process.  We ask all involved to discuss risks within the area or process and to contribute to suggestions for managing/reducing the risks.  We then discuss with you our observations and the feasibility of audit recommendations.  Our reports usually present a consensus (e.g., audit issues and recommendations) which are accepted and supported by management. 

Planning and Fieldwork Process

Initially, the planning process involves an opening meeting followed by interviews with line management to obtain a firm understanding of how the area or process is organized.  This planning contributes to the creation of an audit program.  We then identify the controls that management has in place to ensure that activities are performed according to their expectations. Once controls are identified, we devise tests that allow us to determine the effectiveness of the controls. If we determine that a control is not working effectively, we will bring this to the attention of line and/or senior management, as appropriate, in the form of an issue.  This process allows us to collectively examine and confirm our findings. If an issue is confirmed, the issue recommendation and corresponding action plan are discussed with management. Once fieldwork and testing are completed, we create a list of all issues identified and present this for verification at the closing meeting. We will discuss the issues and recommendations with you to obtain mutual agreement and, if possible, the action plans you are considering.

Individual Audit Reporting

The draft report is the result of the closing meeting. This report includes an Executive Summary and a schedule of all the issues identified, along with our recommendations.  In the event we have consensus on the action plans for the relevant issues from the closing meeting, they will also be included. Operating management will provide any additional comments or action plans that have yet to be determined. Responses to the draft report are expected within 21 days of receipt of the draft report. The final report is issued 15 to 30 days after receipt of management’s comments.

The final report includes:

• An Executive Summary, which includes the background, scope, and significant reportable findings presented to the Audit Committee. It also identifies that management is in agreement by stating the individual who is responsible for the implementation of the action plan, along with the date of implementation.  In the event that Internal Audit and Management disagree on the finding, management would provide a comment to support their disagreement.
• A schedule of detailed issues is provided, listing each issue identified, its impact, recommendations, the agreed upon action plan, the responsible party, and the implementation date.
• Additional schedules, as needed.

Audit Follow-Up Policy

We will contact your office in the future to determine whether corrective actions have been taken.  Additional audits may also be planned, based upon an audit cycle which has been approved by senior management and the Audit Committee. On a quarterly basis we present to the Audit Committee. In the Audit Committee Report, we report on the status of all reportable issues identified in the Executive Summary of each report.  We also report all issues identified in aggregate sorted by the type of issue; financial, compliance, operational or information systems.

 Audit Process FlowChart