OLD DOMINION UNIVERSITY University Policy Policy #3004 POLICY ON INTERNAL AUDIT RESPONSE PROCEDURES Responsible Oversight Executive: Vice President for Administration and Finance Date of Current Revision or Creation: September 30, 2009 A. PURPOSE The purpose of this policy is to establish the policy that will govern the process for responding to audit findings and recommendations contained in reports issued by the Internal Audit Department. B. AUTHORITY Virginia Code Section 23‐9.2:3, as amended, grants authority to the Board of Visitors to establish rules and regulations for the institution. Section 6.01(a)(6) of the Board of Visitors Bylaws grants authority to the President to implement the policies and procedures of the Board relating to University operations. Old Dominion University Board of Visitors Policy 1610 – Charter of the Internal Audit Department C. DEFINITIONS N/A D. SCOPE This policy applies to all University administrators and department heads. E. POLICY STATEMENT It is the policy of Old Dominion University that all areas that are the subject of an internal audit review be provided an opportunity to respond to issues identified and recommendations made. These responses will be included in the body of the audit report, which will be submitted in draft form to the appropriate vice president for review, prior to final issuance to the President ...
OLD DOMINION UNIVERSITY University Policy Policy #3004 POLICY ON INTERNAL AUDIT RESPONSE PROCEDURES Responsible Oversight Executive:President for Administration and Finance Vice Date of Current Revision or Creation:September 30, 2009 A. PURPOSEThepurposeofthispolicyistoestablishthepolicythatwillgoverntheprocessforrespondingtoauditfindingsandrecommendationscontainedinreportsissuedbytheInternalAuditDepartment.B. AUTHORITYVirginiaCodeSection23‐9.2:3,asamended,grantsauthoritytotheBoardofVisitorstoestablishrulesandregulationsfortheinstitution.Section6.01(a)(6)oftheBoardofVisitorsBylawsgrantsauthoritytothePresidenttoimplementthepoliciesandproceduresoftheBoardrelatingtoUniversityoperations.OldDominionUniversityBoardofVisitorsPolicy1610–CharteroftheInternalAuditDepartment
C. DEFINITIONSN/AD. SCOPEThispolicyappliestoallUniversityadministratorsanddepartmentheads.E. POLICYSTATEMENTItisthepolicyofOldDominionUniversitythatallareasthatarethesubjectofaninternalauditreviewbeprovidedanopportunitytorespondtoissuesidentifiedandrecommendationsmade.Theseresponseswillbeincludedinthebodyoftheauditreport,whichwillbesubmittedindraftformtotheappropriatevicepresidentforreview,priortofinalissuancetothePresident.UniversitydepartmentsaretorespondtointernalauditreportsandrecommendationsinatimelymannerandintheformatprescribedbythispolicyandtheUniversityAuditor.Theadministratorofadepartmentthathasbeenauditedshallbeprovidedthreeweekstorespondtoauditfindingsandrecommendations.Policy #3004 – Policy on Internal Audit Response Procedures1
F. PROCEDURESOnceadepartmenthasbeenpresentedwiththeauditfindingsandrecommendationsindraftformat,thedepartmentheadordesignatedindividualshalldraftresponsestotherecommendations.Theresponsesshouldbewritteninsuchawayastoclearlycommunicate,toallreadersofthereport,agreementordisagreementwiththeissuesidentified,plannedcoursesofaction,responsibilityforthosecoursesofactionandatimelineforcompletion.Responsesshouldbeasconciseandtothepointaspossible,anddirectlyrelatetotheissuesandrecommendationsidentifiedinthereportandplannedcorrectiveactions.Inordertopromoteuniformityandclarityacrossdifferentauditreports,theInternalAuditDepartmentwillaskthatresponsesbeinastandardizedformat,whichcanbefoundontheInternalAuditDepartment’sWebsite.Responsesshouldbewrittenandreturnedwithinthreeweeksasprescribedbypolicy.Theappropriatevicepresidentshallbenotifiedshouldtheresponsibleadministratornotrespondtotheauditfindingsbytheassigneddeadline.Thevicepresidentshallberesponsibleforensuringthattheresponseissubmittedwithinfive(5)workingdaysfollowingnotificationfromtheUniversityAuditorthattheresponsewasnotreceived.ThevicepresidentwillbeaccountabletothePresidentforensuringthattheresponseissubmittedwithinthefive(5)dayperiod.TheUniversityAuditorwillreviewcorrectiveactionsthatareproposedbytheadministratorresponsiblefordepartmentaloperations.Adraftreportincorporatingthefindings,recommendations,andcorrectiveactionswillbepreparedandsubmittedtothevicepresidentoftheareaforreview.Incaseswheretheactionsproposedbytheresponsibleadministratorwillnotcorrectthedeficiency,anexceptionwillbetakenbytheUniversityAuditor,andthevicepresidentshallobtainthePresident'sconcurrencethattheUniversityiswillingtoaccepttheriskofnottakingcorrectiveactionorsubmitarevisedacceptableresponse.Allpartiesareexpectedtoworktogethertoresolveoutstandingissueswithinthreeweeks.Oncethisprocessiscomplete,thefinalreportisissuedtothePresident.TheInternalAuditDepartmentwillconductafollow‐upreviewtodeterminethatcorrectiveactionswerecompleted.Theappropriatevicepresidentwillberesponsibleforthetimelycorrectionofoutstandingdeficienciesnotedinthefollow‐upreport,andshalljustifytothePresidentthecauseforthedelayincorrectingdeficienciespreviouslyidentified.Undercertaincircumstances,itmaybeappropriateforthevicepresidenttoobtaintheconcurrenceofthePresidentthattheriskofnottakingactionisacceptabletotheUniversity.Justificationsandcorrectiveactiondeadlineswillbeincludedinthefollow‐upreportissuedbytheUniversityAuditortothePresident.G. RESPONSIBLEOFFICERUniversityAuditorH. RELATEDINFORMATIONUniversityPolicy3002–AuthorityoftheInternalAuditDepartmentOfficeoftheUniversityAuditorWebsite/ResponseProceduresPolicy #3004 – Policy on Internal Audit Response Procedures2
POLICY HISTORY ************************************************************************ Policy Formulation Committee (PFC) & Responsible OfficerApproval to Proceed: _________________________________ ___________________________ Responsible Officer SignatureDate Policy Review Committee (PRC) Approval to Proceed: /s/ Donna W. MeeksMay 26, 2009 Policy Review Committee (PRC),Date Chair SignatureExecutive Policy Review Committee (EPRC) Approval to Proceed: /s/ Robert L. FenningSeptember 29, 2009 Responsible Oversight Executive SignatureDate Presidential Approval: /s/ John R. BroderickSeptember 30, 2009 President Date Policy Revision Dates:November 1, 1990; September 30, 2009 Scheduled Review Date: September 30, 2014
Policy #3004 – Policy on Internal Audit Response Procedures