University Policy 3004

Code of Virginia Section 23.1-1301, as amended, grants authority to the Board of Visitors to make rules and policies concerning the institution. Section 6.01(a)(6) of the Board of Visitors Bylaws grants authority to the President to implement the policies and procedures of the Board relating to University operations. Section 7.01 of the Board of Visitors Bylaws grants specific authority to the Chief Audit Executive.

Board of Visitors Policy 1610 - Charter of the Internal Audit Department

N/A

This policy applies to all University administrators, including, but not limited to, the President, Vice Presidents, department heads, and directors.

It is the policy of Old Dominion University that all areas that are the subject of an internal audit review be provided an opportunity to respond to issues identified and recommendations made. These responses will be included in the body of the audit report, which will be submitted in draft form to the appropriate vice president for review, prior to final issuance to the President.

University departments are to respond to internal audit reports and recommendations in a timely manner and in the format prescribed by this policy and the Chief Audit Executive. The administrator of a department that has been audited shall be provided a minimum of two weeks to respond to audit findings and recommendations.

Once a department has been presented with the audit findings and recommendations in draft format, the department head or designated individual shall draft responses to the recommendations. The responses should clearly communicate, to all readers of the report, agreement or disagreement with the issues identified, planned courses of action, responsibility for those courses of action and a timeline for completion. Responses should be as concise as possible, and directly relate to the issues and recommendations identified in the report and planned corrective actions. In order to promote uniformity and clarity across different audit reports, the University Audit Department will ask that responses be in a standardized format, which can be found on the University Audit Department's Website.

Responses should be written and returned within two weeks as prescribed by policy. The appropriate Vice President shall be notified should the responsible administrator not respond to the audit findings by the assigned deadline. The vice president shall be responsible for ensuring that the response is submitted within five (5) business days following notification from the Chief Audit Executive that the response was not received. The vice president will be accountable to the President for ensuring that the response is submitted within the five (5) day period.

The Chief Audit Executive will review corrective actions that are proposed by the administrator responsible for departmental operations. A draft report incorporating the findings, recommendations, and corrective actions will be prepared and submitted to the Vice President of the area for review. In cases where the actions proposed by the responsible administrator will not correct the deficiency, an exception will be taken by the Chief Audit Executive, and the Vice President shall obtain the President's concurrence that the University is willing to accept the risk of not taking corrective action or submit a revised acceptable response. All parties are expected to work together to resolve outstanding issues within three weeks.

Once this process is complete, the final report is issued to the President.

The University Audit Department will conduct a follow-up review to determine whether corrective actions were completed at the proposed implementation date. The appropriate Vice President will be responsible for the timely correction of outstanding deficiencies noted in the open action item report and shall justify to the President the cause for the delay in correcting deficiencies previously identified. Due to certain circumstances, it may be appropriate for the Vice President to obtain the concurrence of the President that the risk or consequence of not taking action is acceptable. Justifications and corrective action deadlines will be included in the open action item report issued by the Chief Audit Executive to the President.

Applicable records must be retained for three years following the end of the fiscal year in which the records were closed and then destroyed in accordance with the Commonwealth's Records Retention Schedule (General Schedule Series 102, Series 012086).

Chief Audit Executive

• University Policy 3002 - Authority of the University Audit Department
• Audit Response Procedures