1. How are university areas selected for audits?
Areas are selected for review in several ways: our annual audit risk analysis, state or federal requirements, and special requests or other circumstances such as investigations.
Each year the audit staff performs a risk analysis of UT departments or auditable areas to determine next year's audit schedule. The following factors are considered in determining the relative risk of each area to the university:
- Findings from prior audits
- Time since last audit
- Size and/or complexity of operations (by budget or transactions)
- Whether the department collects revenue and/or volume of collections
- Recent changes in management, staff, and/or operating systems
- Public sensitivity
- Evaluation of internal controls
- Comments and concerns of senior management
We use this information to establish priorities and develop our annual audit schedule. Because Internal Audit operates as a service to management, our schedule is open to possible revision any time during the fiscal year to accommodate administrative requests or other special circumstances.
Return to top
2.
What are auditable activities?
Auditable university activities may include:
- Cost centers and auxiliary services
- General ledger account balances
- Information systems (manual and computerized)
- Grants and contracts
- Academic programs
- Athletics programs and NCAA compliance
- Equipment inventory
- Functions such as information technology, procurement, financial aid, and human resources
- Transaction activities such as sales and accounts receivable, purchasing, accounts payable and disbursement, inventory management and valuation, and payroll
- Financial statements
- Compliance with laws and regulations
Return to top
3.
What are internal controls?
"Internal control" is a term commonly used by auditors as they plan and carry out departmental audits. The integrity of the university's accounting and operating systems depends on properly functioning controls. The system of internal control consists of all measures taken by an organization to:
- Safeguard assets from waste and fraud
- Promote accuracy and reliability in the accounting records
- Encourage and measure compliance with policies
- Evaluate the efficiency of operations
Some examples of internal control include separating the duties of handling cash and reconciling deposits; limiting access to petty cash and safe combinations to a few employees; and separating the duties of preparing payroll and distributing paychecks.
Return to top
4.
What internal controls should my department have in place?
Each year university departments are required to complete the Self-Assessment of Internal Controls Questionnaire. To help you determine what internal controls you should have in place, a Self-Audit Sampler is available online. This document contains several self-assessment questionnaires and can be used in conducting a self-audit to evaluate the adequacy of your department's controls. The questions address key areas such as returned checks, movable equipment, and grants and contracts. However, the questionnaires are not interactive and not meant to substitute for completing the annual self-assessment.
Return to top
5.
What happens in an audit?
When an area is selected for review, the following process generally occurs.
Audit Planning
The auditor assigned to the audit will review the files of prior audits in your area (if any), review applicable professional literature, research any applicable policies or statutes, and then prepare an initial audit program, which is basically a list of steps we will perform in the audit.
Opening Conference
This is a meeting between the manager(s) of the area being audited and the internal
auditor(s). In the meeting we explain what we expect to happen in the audit and give you the opportunity to share any concerns you may have. For example, if you would like us to review a particular process or procedure in your unit, let us know at this meeting and we will try to include it in our audit.
Fieldwork
During this process we will likely interview employees in the department to inquire about their duties. We may flowchart the processes being reviewed to better understand and evaluate them. Also, we will perform tests of departmental documents, e.g., payroll and equipment records, to determine the adequacy of the internal controls, or safeguards, in place and compliance with applicable policies. Some of this work will be performed in our office and some in the unit being audited.
Exit Conference
Throughout our review we will try to be open regarding what we find and plan to recommend in the audit report. Once we complete the fieldwork, we will meet informally with departmental management to discuss our preliminary results. If we have misinterpreted anything in the review, or if you disagree with our conclusions, you have the opportunity to let us know so that we can make clarifications before issuing our report.
Report Writing
After the exit conference, the auditor in charge will write a report stating what we did, what we found, and any recommendations for improvement.
Management Response
When we have completed a draft of the report, we will send a copy to the department head for his or her review. At this point we will ask for management's written response to the recommendations, which will be included in the report.
Reporting Process
The report will be sent to all levels of management involved in the audited area, other university officials, and the audit committee of the Board of Trustees. Each month an executive summary of reports issued is sent to the president and the audit committee.
When the report is distributed, we will request your written response within thirty days regarding the recommendation(s) made and your planned corrective action(s). After receiving your response, we will determine whether your planned actions are appropriate.
Follow-up Process
Occasionally we will follow up to determine whether the recommendations have been implemented. If they have not been implemented, we will restate in writing the reason(s) for and importance of addressing our recommendation(s).
Return to top
6.
What are some examples of dishonest acts that should be reported to Internal Audit?
See Policy FI0130, #6.
Return to top
7.
How do I report an employee's dishonest acts?
See Policy FI0130, #7-8.
Return to top
8.
How do I report a shortage?
See Policy FI0131, #3.
Return to top
9.
How do I report theft or unauthorized removal of equipment?
See Policy FI0131, #2.
Return to top
10.
When reporting a shortage, theft, or missing equipment, what do I need to tell Internal Audit or the campus police department (or business office)?
- What (or what amount of cash) is missing
- How the situation occurred
See Policy FI0130, for instructions on the appropriate office to notify.
At the conclusion of an investigation, the internal auditor in charge will likely issue a report that will include recommendations to strengthen internal controls and help prevent a similar situation from happening again.
Return to top
11.
Should I confront an employee suspected of dishonest acts?
No. Employees should not initiate investigations on their own nor alert suspected employees of an impending investigation. See Policy FI0130, #8.
Return to top
12.
Should I contact Internal Audit if an external party (e.g., state, federal, grant and contract, or accrediting agencies) has scheduled an audit, program review, or evaluation in my college or department?
Yes. We need to be informed of audits conducted by external parties. Please call 865-974-6611 or send e-mail (jaburns@tennessee.edu) to tell us about the scheduled review.
Return to top
13.
How long must my office retain records?
For guidance on maintaining and retaining the following types of university records, see Policy FI0120.
Business and Financial
Employee Records
Purchasing
Risk Management
Student Records
Transportation and Traffic
Return to top
14.
How does my office write off accounts receivable?
See Policy FI0305, #15.
Return to top
15.
What responsibilities does my office have in the proper maintenance and reporting of equipment inventory?
See Policy FI0605, #5.
Return to top
16.
Should faculty collect money from students?
No. For more guidance on charging and collecting departmental student fees, see Policy FI0310, #10.
Return to top
17.
Should my office collect and pay sales tax to the state on items sold as fund-raisers?
Yes. University departments providing taxable sales, services, amusement (see Policy FI0310, #20), and other activities should collect, report, and pay the sales tax to the state. Fund-raising items may include, but are not limited to, T-shirts, novelties, refreshments (i.e., at a concessions stand), calendars, and other such tangible personal property.
Sales tax should not be paid to vendors when purchases are made with university funds (see Policy FI0525, #11).
If your department is not registered with the Tennessee Department of Revenue and you think it should be, visit their Web sites below (and/or call Susan Wilson in the Treasurer's Office at 865-974-3287 or e-mail wilsons@utk.edu):
Return to top
