Spreadsheet: 16b2a645-87fa-4ba3-bd18-3d6e8c589774
Sheet: Sheet1

FREQUENTLY ASKED QUESTIONS
How are audits selected?
What should I expect during an audit?
What should I do during an audit?
What activities are considered 'auditable'?
Can I request an audit?
What information is accessible to auditors at KCTCS?
How long should I retain records?
Who gets the final audit report?
Why aren't good practices commended in the audit report?
What are internal controls?
What is Risk Management?
Who is responsible for Risk Management at KCTCS?
What should I do if a suspected theft or other impropriety has occurred?
1. | How are audits selected?
 | There are several ways in which audits are selected.  The most common ways are as follows:
 | ● | Normal Schedule - In general, most KCTCS colleges and System-level departments are on a
 |  | recurring audit schedule.  The Office of Audit Services will typically prepare an annual audit
 |  | plan using this schedule to determine which colleges/departments should be included in the
 |  | audit plan for any given fiscal year.
 | ● | Risk Assessment - The Office of Audit Services also considers relative risk associated with a specific
 |  | college/department when determining an audit schedule.  Factors included in this risk
 |  | assessment would include, but not be limited to:  1) Findings from prior audits; 2) Time
 |  | since last audit; 3) Size and/or complexity of operations; 3) Recent changes is management
 |  | [NAME] personnel; 4) Evaluation of internal controls; 5) Degree of regulatory oversight, and;
 |  | 6) Concerns of senior college and/or KCTCS management.
 |  | Leadership Change - Generally speaking, whenever there is a change in a college or department's
 |  | leadership (or in instances where the financial officer has left), an audit is performed to ensure there
 |  | are no major problems or issues that need addressing, as a courtesy to the new leadership.
 | ● | Special Request - While the two aforementioned methods are used to establish priorities
 |  | in developing our annual audit plans, our schedule is always open to revision during the year
 |  | to accommodate special requests or other special circumstances.
 |  | Improprieties - Whenever actual or suspected acts of dishonesty or serious violations of KCTCS policies
 |  | or procedures are reported which may result in loss of cash and/or assets, these instances are given
 |  | immediate priority by us and investigated as soon as we are aware of the situation.
2. | What should I expect during an audit?
 | A willingness on our part to assist you in doing your job better.  We also strive to identify any weaknesses
 | or potential problem areas, and provide ways to fix them so that you can have confidence that your
 | college or department is operating within the policies and procedures of KCTCS.
 | There are several phases of the Audit Process, and an understanding of these phases
 | will help you better understand the process.  The phases of the Audit Process, while sometimes
 | flexible based on circumstances surrounding any potential audit, are generally as follows:
 | ● | Audit Planning - The auditor assigned to your specific audit will review files from the most
 |  | recent audit of your college or department, research any applicable policies or statutes,
 |  | select random samples of transactions to review using automated auditing software, perform
 |  | additional risk assessments to determine any areas that may need extra testing or review,
 |  | and develop an audit program as a guide during the peformance of the audit.  We also inquire
 |  | if there are any areas you would specifically like us to review that may not be covered in our usual
 |  | audit review.
 | ● | Fieldwork - This is the phase of the audit where the auditor will physically be at your college
 |  | or departmental area.  Employee interviews; charting of transaction processes; asset verifications; tests of
 |  | previously mentioned random samples to determine adequacy of internal controls in place; and
 |  | compliance with applicable KCTCS policies and procedures are all typical procedures during
 |  | the fieldwork phase of our audits.
 | ● | [NAME] we try to communicate any issues noted during the fieldwork phase
 |  | of the audit as we go, once the fieldwork is complete will will typically meet (at least
 |  | informally) with college/departmental management to discuss preliminary results.  Typically,
 |  | when audit findings are at a minimum it is less likely that a formal exit conference will take
 |  | place.
 | ● | Report Writing - After fieldwork is complete and the exit conference has been conducted (if
 |  | necessary), the auditor will write a report stating exactly what was reviewed, what was noted,
 |  | and any recommendations for improvement.
 | ● | Draft Audit Report - Once the draft copy of the audit report has been completed, the auditor
 |  | will send a copy to the college/department's management for their review.  This
 |  | gives the auditee the opportunity to inform us of any factual inaccuracies or misinterpretations
 |  | included in the report and to inform us of any disagreements with conclusions so that these issues can be
 |  | clarified and reconciled prior to the issuance of the final audit report.  For this process, we
 |  | typically allow a week from the date of issuance for questions and comments from the
 |  | auditee. | The KCTCS VP of Finance also will review the draft before it is finalized.
 | ● | Final Audit Report - Once all parties are in agreement as to the contents of the audit report, a
 |  | final report is issued.  This final audit report will be sent to the college/department management,and to
 |  | KCTCS senior management and other interested officials.  These reports are also furnished to
 |  | the external auditors each year as part of the KCTCS annual financial statement audit.
 |  | Also, on a semi-annual basis, an executive summary of audit activities and reports issued is
 |  | presented to the KCTCS Board of Regents.
 | ● | Management Response - Once the final audit report is issued, we will request a formal written
 |  | response by management to the recommendations included in the report.  This response should include the
 |  | planned corrective actions to be taken for each recommendation.  These responses are also
 |  | forwarded to selected KCTCS management officials, and are reviewed for sufficiency.
 | ● | Follow-Up - Occasionally, we will follow up to determine whether the recommendations set
 |  | forth in the audit report have been implemented.  Based on the severity of the recommendation,
 |  | this follow-up may be conducted within a short period of time after report issuance (high risk)
 |  | or it may be specifically reviewed when the next audit takes place (low risk).  Either way, if
 |  | planned corrective actions as set forth in management responses have not been implemented,
 |  | a restatement of the issue in writing will be enacted.  Any restatements of previously noted
 |  | recommendations are considered to be more severe than the original exception.
3. | What should I do during an audit?
 | Relax.  Our mission is not to prove that you are doing something wrong or to operate under the
 | "gotcha" mentality.  Rather, the mission of the Office of Audit Services is to contribute to the
 | ongoing effectiveness of KCTCS in its missions of education and training.  You can view our
 | official [NAME] by clicking the following link: |  |  |  |  |  |  | Mission
 | You can also see the objectives in accomplishing our mission at the following link: |  |  |  |  |  |  |  |  | Objective
 | So, the main thing you should do during an audit is just be open and cooperative.  Make all
 | college/department personnel aware that an audit is being conducted and that everyone should
 | answer questions in an honest, straight-forward manner.  Please feel free to voice any questions
 | or concerns that you may have about the information being requested.  It is appropriate
 | to discuss these issues with the auditors.  In the end, this communication will most
 | likely result in a more thorough understanding of the audit, as well as a shorter audit timeframe.
4. | What activities are considered 'auditable'?
 | Technically, any KCTCS activity could be considered 'auditable'.  However, most routine audits
 | are conducted to determine compliance with KCTCS policies and procedures, as well as
 | applicable laws and regulations.  Most audits review the following areas (if applicable):
 | 1) Cash handling (including daily receipts, imprest accounts, reconciliations, electronic transfers, etc.);
 | 2) Tuition and related waivers; 3) Capital Assets and Inventory Management; 4) Purchasing (including
 | Procard, PO's, and check requests);  5) Human Resources and Payroll; and 6) Grants and Contracts.
 | While these are the 'main' areas typically reviewed, there are also several other auxiliary areas
 | that are frequently reviewed during an audit as well.
5. | Can I request an audit?
 | The short answer is 'yes'.  If you feel you are a good candidate for an audit, by all means contact
 | the Office of Audit Services.  However, please understand that there will most likely be a
 | process involved to determine whether or not the requested audit will be undertaken and, if so,
 | when it would commence.  Factors included in this process would include, but not be limited to
 | the following: 1) Urgency of the request (including assessment of circumstances surrounding the
 | request); and 2) Availability of auditors.
6. | What information is accessible to auditors at KCTCS?
 | As stated in the following link: |  |  |  | Authorization and Responsibilities
 | KCTCS auditors have access basically to ALL KCTCS information and records.
7. | How long should I retain records?
 | KCTCS requirements for records retention can be viewed at the following link:
 | KCTCS Business Procedure 1.8
8. | Who gets the final audit report?
 | Typically, all final audit reports are sent to management of the college/department being
 | audited as well as appropriate System Office officials.  These officials typically include: 1) Vice
 | President of Finance; 2) System Director of Business Services; 3) System Director of Accounting;
 | 4) System Director of Treasury; and 5) KCTCS Chancellor.  While this is the typical list for report
 | recipients, any appropriate recipients may be added/removed to the list as circumstances
 | warrant.
9. | Why aren't good practices commended in the audit report?
 | We understand that sometimes an audit report may seem like a laundry list of bad practices,
 | composed mainly of negative issues of varying degrees.  However, before passing judgment, one
 | must understand the objective of an audit report.  The objective of an audit report is to set forth
 | what was found, or noted, during the audit and to inform management of the validity of the
 | findings, moving management toward change and improvement.  To best accomplish these
 | objectives, the most attention is given to audit findings that will ultimately strengthen the control
 | environment and require some type of action from management.  So, the report must be
 | objective and offer an unbiased view of the control environment.  However, we will typically
 | attempt to include at the end of each report an overall assessment as to the status of operations
 | at the college/department being audited which, for those that warrant, will set forth some of the
 | stronger points of the organization.
10. | What are internal controls?
 | For an in-depth description of internal controls and how they may apply to your specific area,
 | please click the following link: |  |  |  | Internal Controls
 | For further details, click the following link: |  |  |  |  | KCTCS Internal Control Guide
11. | What is Risk Management?
 | Wikipedia defines risk management as "the identification, assessment, and prioritization of risks
 | followed by coordinated and economical application of resources to minimize, monitor, and
 | control the probability and/or impact of unfortunate events or to maximize the realization of
 | opportunities".  While that is a good, comprehensive definition of risk management, a simpler
 | definition might be "proactively identifying issues and addressing their potential impact on
 | your college, department, or KCTCS as a whole so that informed business decisions can be made
 | in a timely manner".
12. | Who is responsible for Risk Management at KCTCS?
 | While some departments within KCTCS (including the Office of Audit Services) have aspects of
 | risk management explicitly stated as part of job descriptions, every employee of KCTCS can be
 | responsible and play a part in risk management.  Employees at all levels of an organization are
 | presented with risks in the daily carrying out of job duties.  So, you should always be aware of and
 | understand what areas of risk are present in your current position.  Once you know the areas of
 | risk, you should consider the implications of these risks on yourself, your department/college,
 | and KCTCS as a whole.  To do this, you should ask yourself these questions in each situation:
 | ● | Are there any legal issues?  Is the situation in compliance with all laws and regulations?
 | ● | Is the situation in compliance with all KCTCS policies and procedures?
 | ● | Does this situation compromise my personal and/or professional ethical standards in any way?
 | ● | What would the public think if this situation were to appear in the newspaper?
 | If you don’t feel 100% comfortable answering these questions, you should seek guidance from the
 | Office of Audit Services.
 | Another method for you, as a KCTCS employee, to participate in risk management is to periodically
 | complete the Risk Assessment Questionnaire as provided on the Office of Audit Services website.
 | You can access the document by clicking on the following link: |  |  |  |  |  |  | Risk Assessment Questionnaire
13. | What should I do if a suspected theft or other impropriety has occurred?
 | The first thing you should do is to report it to your supervisor.  If you do not feel comfortable with
 | reporting the issue to your supervisor, you may report it anonymously at the following link:
 | EthicsPoint - Kentucky Community & Technical College System