Section 3342-7-02.17 - Administrative policy regarding fiscal audits by external auditors(A) It is the policy of the university to cooperate fully with external auditors in the performance of their duties. The university requests that external auditors and university personnel involved in fiscal audits, including those of local, state, and federal programs observe certain procedures to facilitate orderly reviews. The office of internal audit has been designated as the focal point for all external audits. Therefore, external auditors are requested to arrange all initial contacts through the office of internal audit. If the initial contact by external auditors is made with other university personnel, the person contacted must immediately advise the office of internal audit.(B) Advance arrangements for external auditors by the office of internal audit will ensure: (1) Proper persons are available to assist the external auditors and liaison appointed.(2) Relevant records are located and made available.(3) Interviews are scheduled so as to provide minimum disruption of departmental activities.(4) Required facilities and services are available.(C) Notification responsibilities. (1) External auditor. It is anticipated that the audit agency will inform the university of proposed audits. Such notice should be directed to the office of internal audit. The written notice should indicate the purpose and scope of the audit. When an entrance conference is necessary that office of internal audit will make arrangements with appropriate university officials.(2) Office of internal audit. The office of internal audit will notify the appropriate department or person regarding all known aspects of the proposed audit. A representative from the office of internal audit or designee will personally accompany the external auditor and introduce him/her to the appropriate university personnel.(3) University departments. If any university department is contacted by an external auditor without prior notification of the proposed audit from the office of internal audit, that department should notify the office of internal audit.(D) Entrance conference. The objectives of an entrance conference when requested are to establish the purpose, scope and timing of the audit, the information required by external auditors, and the physical facilities needed. Entrance conferences will be scheduled by the office of internal audit or designated liaison.(E) Procedures during audit. After the audit commences and until conclusion it is important for the office of internal audit to maintain contact with the auditor-in-charge. The office of internal audit will arrange for audit liaison, additional interviews, provide for additional required documents, answer questions and supplement interviewee statements. The purpose of such contact is to expedite the audit and to correct any erroneous information which may have been inadvertently given. This should expedite the audit and ensure that the auditor obtains information, specifically:(1) University records. External auditors should request the records required from the assigned audit liaison. The request for records will consider the presence of any PII (personally identifiable information) to be protected. The assigned liaison or office of internal audit will arrange for secure data transmission of all electronic records requested to protect PII. The audit liaison will inform the auditor as to the best place, time and method of securing records. The external auditors will be informed where to return the records for refiling by university personnel. In such cases where it is necessary to remove records from an office, the assigned liaison will secure the approval of the supervisor and will comply with the office procedures for identifying records removed from files, including listing and signing for records removed. In such cases where it is necessary to remove records from campus, the assigned liaison will secure the approval of the supervisor and the office of internal audit will further secure approval from: the office of the registrar for academic records, and the office of information technology for any digital transfer to or storage by a third party.(2) University computer facilities. There may be instances where the external auditors require the use of university computer resources to facilitate an audit. In such cases, the auditor-in-charge should transmit the request through the assigned audit liaison to the office of internal audit.(F) Exit conferences. The purpose of these conferences when requested are to information university representatives of the audit findings, to clarify possible misunderstandings, and to identify the issues that are unresolved. In some circumstances, the university may be asked to make preliminary comments on specific concerns. In such cases, external auditors are expected to provide sufficient information, including reference to specific policy, to enable the university to review adequately the comments and provide meaningful responses. When audits are of limited scope and a formal exit conference is not practical or justified, the external auditors should notify the office of internal audit when their field work is complete. The office of internal audit or designated liaison is responsible for scheduling exit conferences.(G) Audit reports and responses. Copies of audit reports shall be sent by the external auditors to the president, senior vice president for finance and administration, senior associate vice president for finance and administration, controller and the office of internal audit. The office of internal audit will in turn distribute copies to the audited unit, secure comments, coordinate or prepare the university response and maintain a central file of all audit reports, responses, and related correspondence. Replaces: 3342-3- 06.1
Ohio Admin. Code 3342-7-02.17
Effective: 3/22/2021
Promulgated Under: 111.15
Statutory Authority: 3341.04
Rule Amplifies: 3341.01, 3341.04
Prior Effective Dates: 11/03/2006, 06/01/2007, 03/01/2015