The Audit Process

Audit Project Selection

Areas selected for audit can come from a variety of sources. These include risk, management requests, surprise audits, and anonymous allegations of fraud, waste, and/or abuse.

Risk must be one of the primary factors in selecting areas for audit. Risk for some aspects of County operations is higher than others for many reasons, including the types of activities, financial and operational impact to the County if something were to go wrong, strength and attitude of management, and the length of time since the areas have been audited. Those areas of the County which are high risk should receive more audit attention than those of lower risk. It should be noted, however, that areas of lower risk should not be ignored; rather, they should be examined with less frequency than higher-risk areas.

In addition to risk, management sometimes has concerns about some areas, or for some other reason believes an audit is desirable. Because one of the goals of the audit function is to be of assistance to management, these management requests are considered seriously in the selection of audits to be performed.

Also, some audits must be conducted on a surprise basis whenever prior knowledge could compromise the integrity of the audit. These types of audits include cash counts, use of the Florida Driver and Vehicle Information Database (DAVID), and reported allegations of fraud, waste, and/or abuse.

Audit

Preparation

Before an audit begins, the Department of Inspector General sends a letter of engagement to management informing it of the audit project. The letter outlines a description of the audit, identifies the audit period, establishes estimated completion dates, and identifies the audit team assigned to the project.

Preliminary Survey

The auditor will review the department's internal control structure, a process which usually is time-consuming. During this phase, auditors research and gather information to familiarize themselves with the objectives, processes, governing authorities, policies and procedures, risks, and controls related to the area under review. Consideration is given to any discussions during the entrance conference, and is incorporated into the audit steps and questionnaires as appropriate. The department directors will be included on any request for information gathered during this phase.

Entrance Conference
At the end of preliminary survey, and before fieldwork begins, the Clerk & Comptroller and the Department of Inspector General meet with management. During this introductory meeting, or entrance conference, the audit team is introduced to management and discusses the activities of the area under review, identifies the specific audit scope and period, and establishes working arrangements for the remainder of the audit process.

Fieldwork

During this phase, auditors focus on objectively gathering and analyzing data (evidence). They perform specific audit procedures and test selected processes or transactions with observations, analysis, evaluation, and verification.

Fieldwork Audit Comments and Observations
At the completion of audit objectives or the conclusion of fieldwork, but prior to drafting a full audit report, the audit comments and observations are sent to management via email with an offer to discuss the comments prior to the release of the draft report and exit conference.

Each comment and observation will include background information, criteria, cause, effect, and recommendation. Responses with corrective action plans and estimated target completion dates also shall be requested. This provides an opportunity for management to present the audit team with any issues they have regarding the audit comments and for the auditors to seek clarification from management. A formal request for management responses does not take place at this time, but management’s response to the comments and recommendations is encouraged, and a due date is included. There are no surprises for management in the reporting phase after the draft fieldwork audit comments are distributed.

Reporting

After the distribution of fieldwork audit comments, a draft of the full audit report begins. The draft report takes into consideration the results of meetings or information that resulted from the distribution of the fieldwork audit comments and organizes the audit conclusions into a logical document based on fieldwork.

Draft Report and Exit Conference

The draft report, with management’s responses received as a result of fieldwork audit comments in Phase 3, is emailed to management for review. Responses should include corrective actions to be taken and their estimated target completion dates. Management responses are due no later than 20 days after they are requested.

The exit conference provides an opportunity for management to present the audit team with any concerns it has regarding the draft report and for the auditors to seek clarification from management.

As a result of the exit conference, the draft report is edited as necessary to include information discussed. The report is finalized and sent to the Clerk & Comptroller for final review and signature. The report is included on the next available public meeting agenda, and is presented to the Board of County Commissioners for approval and acceptance. Approximately 12 to 18 months after the audit report is accepted at the public hearing, a follow-up review is conducted. The purpose of this review is to verify the corrective actions reflected in management’s responses were effected.