Responding To An Audit
Responding To An Audit
During the exit conference, you should be given a copy of the draft report. The exit conference is an opportunity to correct any factual errors or assumptions in the audit so that the audit reflects that information. The exit conference also provides an opportunity for you to discuss how you will implement the recommendation made in the audit.
After the exit conference, the auditor will revisit any issues raised at the exit conference and will then forward a final draft to the department director for a response. The director typically has two weeks to write a response that will be included in the final audit report.
Audit responses are usually short and present action plans for addressing the concerns identified in the audit. After each recommendation, the department states whether it agrees or disagrees with the recommendation(s). If the department does not agree with the recommendation(s), it should propose an alternative solution to the problems identified in the audit. If the department agrees with the recommendation(s), the response should include:
- How the recommendation(s) in the report will be implemented;
- Who will be responsible from the department for implementing the recommendation(s);
- When the implementation will be completed.
--------------------------------------------------------------------------------
Sample audit responses:
Recommendation: Conduct monthly or annual reconciliation of revenue received from tenants.
Department Response: Agree. Department accounting staff will reconcile revenue reports from suppliers and tenants every month beginning immediately. This reconciliation will be reviewed by the supervising accountant.
Recommendation: The department should routinely review the schedules and responsibilities of staff working a large amount of overtime.
Response: Agree. Our oversight department will conduct an audit every six months of 100 hour reports to insure they are being conducted properly and to ensure appropriate corrective/disciplinary action is being taken. The results of the first audit covering the first half of 2020 will be presented to the department director around July 15, 2020.
Recommendation: Agencies should ensure that they have virus protection software installed on all their data systems and PCs. The anti-virus software definitions should be regularly updated at least monthly or more frequently when major virus attacks are discovered.
Response: Disagree. We disagree on the monthly minimum update period. Any virus software must check for new updates every day, without user intervention. The security consultant may choose to publish detailed procedures or guidelines.
For additional examples of report responses, see actual reports that have been recently released.