UMDNJ Internal Audit Process

This document describes the audit process used by UMDNJ Internal Audit. The UMDNJ Internal Audit Department will utilize a Risk Based Audit Approach (RBA) to determine the scope of work to be performed.

Annual Work Plan
A Risk Assessment, as required by the Standards for the Professional Practice of Internal Auditing, is performed on the organization at least annually to develop effective audit work schedules. The principal components of the risk assessment process include identification of auditable activities, utilization of relevant risk factors, and an assessment of their relative significance (likelihood and impact). The results of the risk assessment are reviewed with Senior Management for their input and feedback prior to presenting it to the Audit Committee for their approval. Audits may also be initiated as a result of a management request.

Individual Audits
The Senior Audit Manager prepares an Engagement Letter announcing the audit and outlining the areas of focus. The Engagement Letter is addressed to management responsible for operations in the areas under review.

UMDNJ audits are designed to be a highly interactive process. Area management is contacted by the assigned internal auditor to review the details of the audit.

Area management participation and cooperation throughout the audit is important. During the audit, any issues that are identified as “opportunities for improvement” will be presented to management for review and discussion. Early communication of issues will provide area management with the opportunity to begin preparing well-defined action plans to address each issue requiring improvement.

At the conclusion of the audit, a closing meeting will be held to summarize the results of our work. An initial draft of the audit report will be discussed. The initial draft audit report will contain our observations, recommendations, opportunities for improvement, and a section for management action plans.

The initial draft will be revised to reflect discussions that have taken place at the closing meeting and then sent out to area management responsible for corrective action. Each management action plan section in the draft audit report will require management to provide written responses and target completion dates. UMDNJ’s Audit Committee has requested that written management action plans be provided to Internal Audit within ten days from the date the draft audit report was sent out. (Refer to the section on Management Action Plans Requirements and Guidelines for details on management action plans.)

The final product of the audit will be a formal written report summarizing opportunities for improvement, describing recommendations for addressing them, and management’s action plans.

All final audit reports will appear in the next Audit Committee package for Committee review and discussion.