Audit Process

The purpose of the preliminary survey is to gain an understanding of the program or activity being audited. We review written procedures, memoranda, organization charts, and budgets. We interview program staff. We collect, summarize, and evaluate information that will be used to identify potential audit issues and develop an audit program. A good preliminary survey is essential to a successful audit. Risk Assessment: The purpose of risk assessment is to focus audit work on important program elements that may be at risk. This helps limit the amount of testing we need to do, and produces a more cost-effective, timely, and relevant audit. The objectives of risk assessment are to

• Identify the major risks or threats associated with the program;
• Conduct a preliminary assessment of the internal controls that management has in place to mitigate those threats; and
• Develop an audit program to test areas of highest vulnerability.

During fieldwork, the audit team identifies performance criteria, gathers evidence, and measures and evaluates performance. Auditors use a variety of investigative techniques including observing, interviewing, sampling, analyzing, and verifying. Audit findings include five elements:

• Condition (what is),
• Criteria (what should be),
• Cause (what happened),
• Effect (why does it matter), and
• Recommendations.

During the audit, audit staff discusses issues with line management and staff as they arise. Once fieldwork is complete, audit staff prepares the first draft of the written audit report and holds an exit conference with management to review the findings. City staff provides feedback and comments on the draft. Meanwhile, audit staff verifies that each statement of fact in the report is supported in the audit working papers. These processes help ensure that the report is balanced and accurate. The wrap up phase of the audit process also includes a final quality assurance review of the audit assignment. The final audit report summarizes key issues, the findings and recommendations, and includes management’s verbatim response. Audit reports are public documents. They are issued to the City Council, Council Appointed Officials, staff, and the media via the established City Council packet distribution.