Preparing for an Audit
If you were on the receiving end of an audit, what would you do to prepare for a known audit or be proactive in preparing for any potential review? Pick a specific functional area of focus if desired.
I think the most prudent approach to preparing for audits is to assume that you are going to be picked and always try to remain prepared. This on-going preparation could include well documented policies and procedures, unannounced internally conducted peer audits, and the utilization of third party auditors. It would also necessarily include diligent monitoring of existing standards and regulations to allow for timely adjustments to the expectations of regulating bodies.
I agree that the best way to "prepare" is to always operate in compliance with internal policies and procedures which should already be compliant with any external regulators. Most regulators initially approve a school based on their documented policies and procedures. If those are actively in force, an audit should not require a last minute scramble to have things in order. However, I often see schools doing that last minute fire drill to obtain and organize items including documents for student files, proof of credentials for faculty files, etc.
In addition to diligent monitoring, solid management control mechanisms which either prevent or reduce risk and/or trigger notifications of any compliance breach or exposure can also ensure that things are in place without having to do a lot of additional preparation.
I couldn't agree more. I also think that even the most diligently prepared, best managed schools get that lump in their throats at the mention of the term "audit." In my experience, last minute hysterics in an attempt to put things in order usually produce little impact on the results of the audit while serving to magnify exponentially, to the point of restrictrd breathing, that good old lump in the throat.
I always sought to ensure my employees that we did good work everyday and that we needed to view any audit findings as a challenge simply to do better work. I don't think they were ever satisfied with my philosophy, however.
The concept of "audit" does create apprehension for most people. Part of my interest in the process of internal audits is to demonstrate that an auditor can have the same goals as the campus/department reviewed and that by identifying issues internally,t here is even more opportunity to meet the challenge of improvement before the matter becomes a serious issue.
Unfortunately, some auditors, internally and externally, take a "gotcha" approach to the process which further instills the fear you mention. Part of audit preparation may need to include coaching those who will be involved to do some deep breathing to reduce the "lump in the throat" syndrome!
I feel the most important part of preparing for an audit, is to always follow the procedures set up to make sure nothing is missed. Having checklists on folders (for example: admissions folders with everything listed to complete the admissions process). I have the registrar do the checklist and when I sign the acceptance letter I also do a quick check.
I think all schools need to do a self audit when they know they are having a visit from an outside agency. It usually identifies potential problems that can be resolved before a regulatory body audits the school. There are always some wrinkles that creep into policy and procedures regardless of how well they are written. If the school has an audit team then that team should conduct an audit to assist the school with preparation.
If the school does have its own Audit Department that is conducting a visit I think they need to be reviewed as they stand. Internal Audits need to identify issues of non compliance. Having a school try and clean everything up before your “Team Mates†audit your school may not help identify problem areas that may need to be addressed globally within your school system.
I agree with Kathleen and Richard regarding internal/self auditing in preparation of a known audit. One of our colleges had its accreditation grant expiring last year and prior to the accreditation team visit we did internal audits at each of the campuses. Our campus administration was totally convinced that the internal audits (we called them reviews) were unnecessary. But what we and they found out - was that even though the policies were clearly documented, it was not always clear from the paperwork left behind that they had been followed to the letter. Fortunately it wasn't a major problem in any of the issues we found - but the campus administration had to go back and find out why certain things were done (example: why did that prospective student get to take the assessment test three times instead of the two times allowed in the policy (because there was a power failure in the middle of the second attempt and the computer system still counted it)) and then document the information. That is one of the reasons we have decided to implement some type of annual review at all of our campuses. What we haven't determined is whether to use campus based employees to make up our "review teams" or to bring in outside people for a truly fresh look for the annual reviews. Do any of you have experience with this?
At our school we have our own department that conducts audits. The staff has been developed from within our school. They are familiar with our procedures and we ensure that they get to accreditation workshops/seminars, Department of Ed workshops/seminars, and all others that effect our ability to stay compliant. This has been successful since our staff has been in the trenches and has some insight into what the schools are going through. Our Internal Audit Team thinks of themselves as a part of the school team and as trainers in addition to being “the Auditorsâ€. I feel this helps with lines of communication.
The "trainers" idea is great! We had the biggest push back last year with our internal reviews because we initially used the word "audit". I would love to have a dedicated team for this but think I may have to do with borrowing from the campus staff and academic teams for at least the first year. However I will incorporate the training aspect into the reviews. Thank you so much!
Lori - Thanks for sharing your experience of having an internal audit directly help in identifying areas which could be addressed prior to an external accreditation visit. This demonstrates a great positive outcome and I am impressed that you are now implementing an annual review at each campus.
At one company I worked for, audit teams included members of the internal audit department plus we implemented a "guest auditor" program whereby we invited campus based employees (usually no more than one for any given audit) to be part of the team. We would train them on how to conduct some of the testing. It was mutually beneficial as the guest auditors gained insight on what to look out for at their own campus and they in turn helped the internal audit members see different angles and approaches which sometimes prompted us to modify our testing to catch additional areas of risk.
There is no substitute for preparation and oversight in the implementation of compliance activities. We too undertake unannounced internally conducted audits to insure that all functional units are in compliance ... at all times.
Traci: Do you feel it is important to have an dedicated internal audit team? We are struggling with the idea (and cost) of using a dedicated team. If we do, I will use your idea of incorporating campus based employees in some way -I think that will help them learn what is necessary and also give us (me) insight that we/I wouldn't already have. The impression I have gained from the responses here seem to indicate that a dedcated team is the way to go.
Lori - Certainly it's nice to have a dedicated team from a resource perspective. However, I don't think it's bad to structure it the way you indicated. My main concern would be the risk of "higher priorities" causing you delays in actually getting to conduct the audits. The other factor to consider is the size of your organization. It's not unusual for companies to have a shared resource structure until they hit a certain size at which point a dedicated team seems warranted.
The audits themselves could be very successfully utilizing resources that really "know" the ins and outs. It's mostly the risk of distraction of day to day operations that would worry me in the big picture. I was in an environment recently where we did not have a dediciated team and that is exactly what happened and we delayed many of our audits from the original schedule. But if you can ensure that you will stick to an audit schedule without resources being pulled away, it could be successful. The bottom line is that it's better to do something than nothing. If for budgetary reasons, you structure it with resources that carry multiple responsibilities, I would suggest proceeding with it and documenting the beneficial outcomes in a way that may help you justify dedicated resources in the future if you experience the concern I have or if your institution grows to a size that warrants.
Traci - thank you those were great ideas. I will document the outcomes and also be diligent regarding sticking with my schedule.
Traci-
I am interested in the "guest auditor" program as we are not quite ready to commit to a dedicated internal audit team. What were the criteria you used to determine who would be invited to participate?
My thought was to somehow tie it into a leadership development program. Participants in the program would be those who want to grow and develop their overall knowledge base of the industry, but who have had, perhaps, experience in only one or two operational areas. I would think that learning the audit process and conducting an audit would give the employee a solid overview and understanding of another operational area.
Cheryl - I will post some information on the guest auditor program this weekend. I think it's great to tie it into a leadership development program.
Prepare to present to the Auditor the companies operating procedures, make sure that all documents are available upon request and that financial reports are completed. Is it really necessary to have a outside source doing the audit instead of someone from inside the company.
Robert - you mention a key item - making sure all documents are available upon request. Failure to produce documents not only leads to findings but, also give cause for concern on the overall operations of the campus. Demonstrating the ability to provide info promptly gives auditors a sense that the campus is organized and operating smoothly.
With regard to your question on internal vs external, there are varying points of view but, if the appropriate structure is in place, an internal audit team can certainly be successful. There are various charter document samples on the web that outline some points to consider in structuring an internal audit department. I will try to review a few and post a couple to this forum for consideration.
I agree with this position every department, financial aid, adminsions office, scholarships and all departemnets they are in compliance with the regulations of the DOE and with the school policy.
It is important to prepare for the 100% of the scope.
