Auditors look at how the internal controls, within an operation, work together to make up the internal control structure. The auditor gathers information about the mission and processes of the unit, discusses the major objectives with the manager, and identifies control points within each process where an error, irregularity, or inefficiency is likely to occur. The auditor documents existing controls at each significant control point, evaluates the adequacy of the controls to ensure achievement of the objective, and then tests the controls to verify they are working as described. Further discussions with the manager focus on control risks, manager insights, and potential control enhancements. The greater the risk, the more extensive the control that is warranted.
Organizational charts provide a visual presentation of lines of authority.
Periodic updates of job descriptions ensures that employees are aware of the duties they are expected to perform. Authorization Procedures - should include a thorough review of supporting information to verify the propriety and validity of transactions. Approval authority should be commensurate with the nature and significance of the transactions and in compliance with Indiana University policy. Time records should be signed by the employee and supervisor with direct knowledge of the employee's work schedule. An account manager may delegate signature authority only to an exempt employee or an appointed biweekly employee.