The basic response procedures for an internal audit report are outlined in University Policy No. 3004. The following notes the proper format in which the response should be written, in order to promote a standardized format that clearly communicates to all readers of the report agreement or disagreement with the issues identified, planned courses of action, responsibility for those courses of action and a timeline for completion.
Responses should be as concise and to the point as possible, and directly relate to the issues and recommendations identified in the report and planned corrective actions. Responses should be written and returned within the time period prescribed by policy.
For each issue identified in the report, and for which recommendations are made, the response should be in the following format:
If management agrees with the issue identified:
- Issue: (Name of issue as noted in report)
- Agree or Disagree: Agree
- Planned Corrective Action: (Detail planned actions that will address each point of the recommendation)
- Responsible Person: (Note name and title of individual responsible for implementing corrective action)
- Planned Completion Date: (Note date in which corrective actions should be complete)
If management disagrees with an issue or recommendation based on their analysis of the situation, and no corrective action is planned:
- Issue: (Name of issue as noted in report)
- Agree or Disagree: Disagree
- Reasons For Disagreement: (Detail reasons why management believes no corrective actions are needed)
- Responsibility Statement For Non-Corrective Action : (State name and title of individual that accepts responsibility for accepting any risks that may be involved in deciding that no corrective action is necessary for this issue)
Follow-up
Audit follow-up will occur on or near the planned date for completing corrective actions. Our office will contact the department to request the status of actions taken or the status of planned actions. Audit testing will be performed as necessary to determine the extent to which the actions taken address the concerns of the audit point and recommendations, and the status will be noted as one of the following:
Actions taken completely address the concern cited in the audit point or were rectified to the extent reasonably possible.
Corrective action is actively taking place. , Some aspects may be complete; however, additional steps need to be taken to address all the main concerns of the original issue.
An action plan has been decided upon but has not yet commenced or only minimally begun.
The original condition still exists. Subject to the approval of the respective vice president, and President management accepts responsibility for not acting to substantially reduce the risk.
The follow-up process will continue at pre-determined dates until the open item is completed or the risk is formally accepted by management.