An IACA Annual Work Plan is developed and approved by the Audit Committee of the RIT Board of Trustees based on an assessment of risk across the University. There are three parts to an audit or business process review engagement: planning, fieldwork, and reporting.
A formal report is prepared and shared with the engagement area's management, the audit committee, applicable RIT administration, and RIT's external auditors. The report includes an assessment of the internal control environment and summarizes the issues identified during the engagement and corresponding management corrective action plans. Discussion items (items of lesser concern) may also be identified during an engagement. As such, these discussion items are shared only with the engagement area's management and do not require the development and implementation of management corrective action plans. These items may represent opportunities for enhancing controls, increasing efficiencies, or improving operations.