- Operational Audits - Examine the use of unit resources to evaluate whether those resources are being used in the most effective and efficient manner to fulfill the University’s mission and objectives. An operational audit may include elements of the other audit types listed below.
- Financial Audits - Focus on accounting and reporting of financial transactions, including commitments, authorizations, and receipt and disbursement of funds. The purpose of this type of audit is to verify that there are sufficient controls over cash and cash-like assets, and that there are adequate process controls over the acquisition and use of resources. Unlike external financial audits, internal financial audits do not prepare or express professional opinions on the fairness of the presentation of financial statements.
- Compliance Audits - Review adherence to laws, regulations, policies, and procedures. Examples include federal and state law, policies, and directives. Recommendations typically call for improvements in processes and controls intended to ensure compliance with regulations.
- Information Systems (IS) Audits - Examine the internal control environment of automated information processing systems and how people use those systems. IS audits typically evaluate system input, output, and processing controls; backup and recovery plan; system security; and computer facility reviews. IS auditing projects can focus on existing systems, as well as systems in the development stage.
- Internal Control Reviews - Focus on the components of the university and auxiliary organization major business activities. Areas such as payroll and benefits, cash handling, inventory and equipment and their physical security, grants and contracts, and financial reporting are usually subject to review.
- Investigations - Seek to establish evidence of impropriety; imply a systematic track-down of information the auditor hopes to discover or needs to know. Investigations include alleged instances of fraud, waste and abuse, and improper governmental activities.
- General Info Link: https://www2.calstate.edu/csu-system/administration/audit-and-advisory-services/Pages/types-of-audits-and-standards.aspxAuditing Info from Cal State Fair Use for non-profit news reporting, education and commentary.
Internal vs. Compliance Audit
Internal audits are carried out by employees of an organization to gauge overall risks to compliance and security and to determine whether internal guidelines are being followed. Internal audits occur throughout the fiscal year and reports can be used by management teams to identify areas that require improvement. Internal audits measure company objectives against output and strategic risks.
External audits are formal compliance audits that are carried out by independent third parties and follow a specific format that is determined based on the compliance regulation being assessed. External audit reports measure if an organization is complying with state, federal or organization regulations, rules and standards.
An auditor's report is used by regulators to assess possible fines for noncompliance, or to prove regulatory compliance.
Compliance Audit Procedures
External audits begin with a meeting between organization/department representatives and compliance auditors to outline compliance checklists, guidelines and the scope of the audit. The auditor conducts reviews of employee performance, studies internal controls, assesses documents and checks for compliance in individual departments.
Auditors review compliance processes as a whole and create a final audit report. Compliance auditors provide details to leadership about the organization's level of compliance adherence, any violations and suggestions for improvement. The audit report is eventually released publicly.
Importance of Compliance Auditing
Compliance auditing, either internal or external, can help identify weaknesses in regulatory compliance processes and create paths for improvement. In some cases, guidance provided by a compliance audit can help reduce risk, while also avoiding potential legal trouble as a result of non-compliance.
Compliance auditing provides an outline of internal organizational processes that can be changed or improved as regulations and requirements change.
Fair use information for non-profit news reporting, education and commentary from Tech Target - Compliance Auditing - Link: https://searchcompliance.techtarget.com/definition/compliance-audit
Three Standards 1) Governance, 2) Risk Management, 3) Controls - Please refer to the links above from Cal State and Tech Target for more specifics.
