Audits are selected from OCA's annual audit work plan which is based on an assessment of risks and exposures affecting the County, inputs from senior management and the audit universe.
Staff assignment is based on assessment of the essential skills that match those necessary to perform the particular audit.
Auditors must plan and document audit work necessary to define the audit objectives, scope and methodology such that their work will provide reasonable assurance that sufficient, appropriate evidence will support their conclusions.
Risk analysis is a procedure to identify and prioritize threats and vulnerabilities in the area to be audited. It is the quantitative or qualitative measurement of the potential loss and probability of occurrence of an adverse event in the organization. During the planning stage, the auditor should perform an analysis of the audit risks that impact the audit customer to detect high-risk areas where audit effort can be concentrated.
The Entrance Conference is conducted to establish contact with the Department staff that will be affected by our audit process. It also serves to promote understanding between the audit team and the audit customer as to the nature, timing and extent of the audit. The audit objective, audit process, and report format is explained at the conference. The audit customer also designates a contact person available for questions from the audit team, as necessary. The Department staff may ask questions or discuss their concerns during this meeting.
The preliminary review is the research performed to determine what steps could be included in the audit program to achieve the objectives. It helps to identify the risks to which the audit customer may be exposed and the potential impact such risks might have on the County. Preliminary reviews are typically completed through narratives, flowcharts, document samples, and internal control questionnaires. Internal Control Questionnaires help evaluate internal controls related to the recording of business transactions, safeguarding County assets, compliance with policies, and promotion of operational efficiency.
When the Preliminary Review has been completed, the audit program is refined (as it is continuously through the audit) and fieldwork steps are developed and undertaken to accomplish the audit objectives. Substantive tests, which may include physical examinations, financial and statistical analyses, interviews, surveys, sampling, checklists and other methodologies, shall be conducted to achieve audit objectives.
Auditors must obtain sufficient appropriate evidence to provide a reasonable basis for their findings and conclusions. (GAS 7.55) Information in the report must be supported by documentation and not assumptions or speculation. When auditors conclude that sufficient, appropriate evidence is not available, auditors will evaluate whether internal control or other program weaknesses are the cause. (GAS 7.40)
Auditors will exercise professional judgment in pursuing indications of possible fraud, illegal acts, violations of provisions of contracts and grant agreements, or abuse in order not to interfere with potential investigations, legal proceedings, or both.
The report includes the following: a cover memo, scope and objectives, executive summary, and related findings and recommendations. Depending on the type of audit, other information pages may be added.
Before scheduling the exit conference, all working papers and the draft report will be reviewed for confidential or sensitive information, such as Social Security numbers, Driver License Numbers, and/or information pertaining to public safety or security concerns that are protected by law from public release. Protected information, if any, must be completely redacted.
This meeting is intended to explain the draft report, go over the report page by page for content and clarity, and to obtain feedback. It also provides an opportunity to explain the formal response process for the final draft that OCA will subsequently provide to the Department for their written response within 20 business days as required by Section 20.055, Florida Statutes. During the Exit Conference, the Department staff may ask questions, discuss rewording or clarification of the report content, and explain alternative views about the draft. Feedback from the Exit Conference will be considered in preparation of OCA's final draft report.
OCA will make all necessary effort to remind the audited entity of the due date and/or to request their estimate of when a response will be provided. If management response is received by the due date, it shall be incorporated into the audit report. If no management response is received by the due date, the Commission Auditor shall note that fact in the final report's transmittal letter and release the audit report.
After an audit report has been reviewed for completeness, accuracy and editorial considerations, it is signed by the Commission Auditor and support staff will assist with printing, binding and distribution of the report. Reports are distributed to County Commissioners, County Manager, County Attorney and audited entity management.
This is a process by which OCA determines the efficiency, effectiveness, and timeliness of actions taken by management on reported engagement observations and recommendations,. Monitoring procedures include an evaluation of whether the audit organization has taken appropriate corrective action to address findings and recommendations or if management has assumed the risk of not taking corrective actions on reported observations.
Follow-up activities shall be scheduled within approximately one (1) year from the time of the final report and in time for inclusion of appropriate information in OCA's Annual Report.
Except for documents related to audit reports that have not yet been issued as final reports, OCA work products are public records that are available for inspection by and release to the public. To the extent that OCA work products include information required by law to remain confidential or protected, OCA shall redact any such information prior to issuance or release of any report, correspondence, recording, email or other document, in any form.
Section 119.0713(2), Florida Statutes, which relates specifically to internal audits prepared for a unit of local government, provides the following exemption from public record requirements until audit reports become final.
"The audit report of an internal auditor prepared for or on behalf of a unit of local government becomes a public record when the audit becomes final. As used in this subsection, the term 'unit of local government' means a county, municipality, special district, local agency, authority, consolidated city-county government, or any other local governmental body or public body corporate or politic authorized or created by general or special law. An audit becomes final when the audit report is presented to the unit of local government. Audit work papers and notes related to such audit report are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution until the audit is completed and the audit report becomes final."