Preparing for an External Audit
Central Piedmont Community College
Tips to Prepare for an External Audit
These tips are specifically for sponsor audits or other external audits, but they may also be used for guidance to prepare for an internal audit.
Planning & Preparation
- Designate an audit liaison person within your organization who will act as the auditors’ main contact. This should be an experienced person with strong project management and communication skills.
- Send a general communication to the process owners and affected faculty and staff stating that if the auditors contact them directly, they should notify the liaison.
- Notify Information Technology personnel of an upcoming audit and keep the key ITS contacts up to date of upcoming service requests and support needed related the audit.
- Review policies and procedures and official documents related to an audit, update them prior to the audit if needed and make them available to necessary staff.
- Have the liaison develop a list of contacts who must be kept informed of the audit progress
- Have the liaison develop a list of people who can provide support on technical issues and gather documentation.
- If necessary, schedule and conduct a general training session with individuals who may be asked to participate in the audit either to produce documents, be interviewed by the auditors or participate in findings discussions.
- Contact auditors and set up entrance conference. Clarify the purpose of the audit and ask that audit requirements be in writing. Develop a list of questions for the entrance conference.
- Alert the Compliance & Audit Office of the upcoming audit. Ask if an internal audit was performed in recent years for the processes included in this audit. If answer is yes, review the audit report ensuring that if there were any findings they were addressed or develop a plan to address them with a time line.
- Meet with key employees and discuss the state of the control environment or ask the internal auditors to perform a quick review. If control weaknesses are found, prepare a log of control weaknesses and document your remediation plans along with firm date for implementing these plans. This document can be shared with the external auditors to demonstrate that you are proactive in identifying and fixing control weaknesses.
- Review documentation, ensuring current information is available. Remove obsolete and/or outdated duplicate versions of documents (shred what is not required to be retained per record retention requirements or per current laws and regulations) to avoid uninvited scrutiny by auditors and to make work areas looking professional and clutter free.
- Make necessary arrangements for the audit team’s entrance conference – meeting rooms, internet access, preliminary interview schedule, entrance conference specifics including attendees.
- Arrange for access to all the areas and systems that auditors might need access to during their field visits and for the tour during entrance conference. Arrange for parking for auditors unless it is easily available. Send auditors maps to entrance conference location and parking information.
- Introduce auditors to the team. Go over housekeeping e.g. Restrooms, evacuation route, meeting agenda, schedule and information such as snacks, lunch etc.
- Discuss the list of questions developed prior to the meeting including the purpose, objectives and scope of the audit; the awards to be included and sampling techniques; timelines including beginning and end of the fieldwork and expected report date; and communication process, future meeting schedules to review audit status and any concerns/questions need to be addressed during the review.
- Consider giving the auditor(s) a tour of the Campus, specifically areas they might be visiting during the field work.
- Determine staffing and space requirements, including whether the auditor will need internet access during fieldwork; arrange for auditor on-site space; modify meeting room needs as necessary.
- Obtain the list of requested records and develop an approach for pulling the information on a timely basis. Give a target date for providing records to the auditors.
- Review the records prior to submission to the auditor. Consider if the records provide the necessary support. Anticipate what questions the records may provoke.
- Maintain a list of all records provided to the auditor/auditors and have them sign off on it.
- Meet (In person or virtual meeting) with auditors at least weekly to learn of the status of the audit and potential issues that are identified.
- Verify the facts on which issues are based; perform re-calculations and review source documents, if necessary.
- Communicate at least weekly with those within the organization who need status updates
- Liaison should attend meetings between faculty/non-financial staff and external auditors unless the auditor insists otherwise.
- Set up exit interview.
- Ask for a copy of each finding or draft report prior to the interview.
- Based on the nature of the issues, ask representatives from other groups to participate, e.g. internal audit, office of sponsored programs, financial services , legal counsel, etc.
- Agree on valid findings; negotiate those findings where the facts are not representative of the control weakness.
- Discuss with the auditors the disposition of the audit issue, i.e. verbal comment, report item, management letter.
- Escalate any disputed issues to supervisors.
- Ask for the final draft report for review.
- Draft management responses and circulate to management for approval.
- Understand the follow-up process.
- Perform a post-audit evaluation to determine weaknesses in the process and potential changes to approach in the future.