Frequently Asked Questions Audit Process What happens during an audit? The audit process consists of seven phases: (1) Engagement Letter, (2) Entrance Conference, (3) Planning, (4) Fieldwork, (5) Exit Meeting, (6) Final Report, and (7) Follow-Up. Please see the Audit Process page for more information. How long do audits generally take? The time an audit last varies tremendously with a number of factors such as size, complexity, and risk of the agency. Based on multiple factors, budget hours are established during the construction of the audit plan and may be revised accordingly by management. What happens if Internal Audit identifies deficiencies during an audit? The OIA will make recommendations for improvements or corrective action for management to take based on findings during its audit. How does an audit impact the staff time and resources of the audited agency? The Office of Internal Audit will need the assistance of staff to provide information and documents; however, we will make our best effort to limit effecting your agency’s operations. What can an agency's personnel do to facilitate the audit process? Be honest and open and participate in the planning process and discussions. It is important that the agency voices its opinions and areas of concern or weakness. Also, give your take on the anticipated effectiveness and feasibility of the OIA’s proposed suggestions for improvement. How far back do you look during an audit? The scope period is determined with the objective of providing results that are relevant and timely. Typically the scope is the last fiscal year, sometimes through current date of audit. However, there are times when audits look at transactions over several fiscal and/or calendar years. Why are follow-up activities conducted within less than one year? Under Rhode Island General Law § 35-7.1-13 it states that “Within one year following the date on which the audit report was issued, the office of internal audit may perform a follow-up audit for the purpose of determining whether the department, agency or private entity has implemented, in an efficient and effective manner, its plan of action for the recommendations proposed in the audit report.” Further, the OIA reports on whether corrective action was taken to its Advisory Group. Report Process Where and to whom does the Office of Internal Audit report? The Office of Internal Audit reports functionally to the Internal Audit Advisory Group and administratively to the Director of the Office of Management and Budget. Who receives the final audit report? Copies are sent to the Director and Deputy Director of the Department of Administration, the Director of the Office of Management and Budget, the Chairperson(s) for the Senate Committee on Finance and House Finance Committee, the Auditor General, and the head of the audited agency. General Questions Why are audits performed? Rhode Island General Law § 35-7.1-1 authorizes the Office of Internal Audit to perform audits of state departments, state agencies, or private entities that are recipients of state funding or state grants. The audits are determined in accordance with a risk-based evaluation, unless there is an issue of misappropriation. The Office of Internal Audit's goal is to provide the Internal Audit Advisory Group and the general public an independent and objective report of program governance, risk management, and control processes and to recommend corrective actions to improve program cost effectiveness and efficiency as necessary. How are Agencies selected for an audit? The agencies selected for audit are primarily based on a risk assessment process. Departments with high risk are audited more frequently than those with medium or low risk. What types of audits are performed? The OIA performs a variety of audits. Please refer to the Types of Audit page for a description and listing of audit types. Why would an Agency request an audit? Agency management requests audits for many reasons. Two main reasons are to receive an independent opinion as to whether a program is complying with all applicable rules and regulations; and to determine if there are program efficiencies that may be gained by changing how the program is managed or staffed. What are the objectives of an internal audit? The objectives of an internal audit are to: Evaluate the effectiveness and efficiency of internal controls and resources employed Review the reliability and integrity of financial and operational information Review fiscal and administrative operations Assess the use of established systems to ensure compliance with corresponding policies, procedures, plans, laws and regulations. What are internal controls? For further information on internal controls, please see OIA’s Internal Control Guide. Reporting Fraud, Waste, & Abuse Is it the responsibility of the Office of Internal Audit to identify fraud? No. Internal Audit tries to reduce the risk of fraud by identifying control weaknesses. However, the OIA will receive and look into allegations of fraud which can be made through the Fraud Hotline page or by calling (401) 574-8175. What should I do if I learn of fraud, waste, or abuse? Upon learning about fraud, waste, or abuse, employees are encouraged to report the matter to management or to the Office of Internal Audit.