

AuditNet ® Audit Programs

- Platform overview
- Perform Inspections
- Create reports
- Capture Issues
- Assign actions
- Workplace communications
- Insights and data
- Build workflows
- Integrate your tools
- Automated Monitoring
- SafetyCulture Marketplace
- Construction
- Hospitality
- Manufacturing
- Transport & Logistics
- Facilities Management
- Incident Management
- Risk Management
- ISO 9001:2015 Quality Management
- ISO 14001:2015 Environmental Management
- ISO 45001:2018 Occupational Health & Safety Management
- Partner Program
- Help Center
- Digitize your form
- Product updates
- Getting started with SafetyCulture Platform
- Getting started with Issues
- Getting started with Heads up
- Events & Webinars
- Checklist Library
- ROI Calculator
- Checklist guides
- Topic guides
- Certifications
- About SafetyCulture
- Brand Partnerships
- Customer stories
Audit Program
Validate your organization’s compliance with an audit program.

Updated 31 Jan 2023 , Published 14 May 2021
What is an Audit Program?
An audit program is a system of audit objectives, scope, timeline, and activities that will be carried out by auditors. An audit program, also known as an audit plan, functions as a guide for conducting various types of audits in a company.
- Why do Audit Programs Matter?
Audits evaluate the effectiveness of an organization’s internal controls. Having an audit program in place helps businesses maintain an effective system of internal controls, obtain objective insights on operations, identify risks of fraud and misappropriation of assets, and lastly, ensure compliance with relevant laws or regulations.
- Types of Audit Programs
Conducting audits is essential in running a business. Having records on every business transaction and operation will ensure accountability in all departments. Depending on the need, organizations can conduct various types of audits. These types of audits can overlap with one another.
- Internal Audit – an internal audit is a type of audit that is done within the organization. This type of audit provides visibility on current finances for the shareholders and board of directors. Internal audits are performed to check whether the financial goals are being met and the business is compliant with regulations.
- External Audit – an external audit is conducted by governing bodies such as the Internal Revenue Service (IRS) or other agencies. The auditor shouldn’t have any connection to the company. These external auditors follow the generally accepted auditing standards (GAAS) and generate audit reports which include the audit processes and information obtained.
- Operational Audit – this audit is commonly performed internally but organizations have the option to do an external operational audit. This type of audit evaluates business operations such as the alignment of company goals, planning processes, procedures, and operational performances. The results of an operational audit are used to improve the business.
- Compliance Audit – this audit checks whether the business is complying with the standards set by the business itself and by external organizations such as the IRS for taxes or OSHA for safety. A reason to conduct a compliance audit is to determine if a business is paying its employees fairly or is giving proper shareholder distributions.
- Information System Audit – this is usually conducted by software, IT, and other technology companies but other businesses that have their own IT department may also participate in an Information System Audit. This audit helps determine software issues that can lead to cyber-attacks and data leaks. Information system audits also ensure that data processing and computer systems are efficient enough for the business.
- Financial Audit – this is regularly used by businesses to analyze the accuracy of their financial statements. Financial audits are required to be conducted by external auditors. Financial audits can be done internally but only for checking purposes. External auditors will share the results to lenders, creditors, and investors.
- Tax Audit – the IRS tax audits are randomly conducted in-person or via mail. This audit will determine if there are any discrepancies on the tax return filed by the business. This means that the taxes filed should be accurate because overpaying or information errors can get you in trouble with the IRS.
- Payroll Audit – this is typically done internally to fix payroll issues that could lead to external payroll audits. It is recommended to conduct annual payroll audits to ensure correct payroll processes are followed and compliant. This audit checks payroll factors such as pay rates, wages, withholding tax, and employee information.
- Pay Audit – Not to be confused with payroll audits, pay audits are used to ensure that employees are paid fairly for their position, rank, skills, and seniority. Factors that may cause disparities are race, religion, age, and gender which have nothing to do with the quality of work. Pay audits also determine fair pay by the business according to location and industry.
- How to Prepare an Audit Program
Before creating an audit plan, the organization should consider the following factors.
- Support and access from the board of directors – Internal auditors need the support of the directors to carry out their assessments. This gives the auditor authority over different business functions and can uncover any mismanagement.
- Independent auditors – this is crucial for an unbiased and objective business assessment
- Level of risk per area – the business should focus on allocating time and resources to conduct regular audits on riskier business functions such as finance and operations.
- Expertise and training – the auditor, whether an internal or external one, has to be knowledgeable and up-to-date on what they are auditing such as financial statements, regulatory compliance, and operations. They must also have an in-depth understanding of international auditing standards such as ISO 19011 .
- Technology – Because manual auditing takes too much time, most auditors currently use digital auditing tools and software. This will help the process become more efficient and free from human error. Another advantage of utilizing digital technology is that auditors and other authorized personnel will be able to access every audit report in one place.
An Effective Audit Program Process
An audit cycle is typically used for auditing financial statements but other types of audits can also utilize its steps. Among the many audit cycle examples, below is a straightforward framework any business can incorporate into its auditing process.

Audit Plan | SafetyCulture
- Audit Program Template Example
While audits can take any form, it’s important to have every necessary detail to pass an external audit or to receive a compliance certification. Here’s an example of an internal ISO 22000 audit that a business can utilize to prepare for external auditors. This audit template can also be used to conduct a compliance assessment of business processes and procedures.

ISO 22000 Audit Checklist | SafetyCulture
- Audit Program Toolkit
Internal audit software helps carry out an efficient audit plan. Here are some examples of audit templates your organization can use with a digital auditing tool.
- Internal audit – this template is an extensive ISO 22000 audit checklist that focuses on the business’ Food Safety Management System (FSMS).
- Internal and external audit – these audit templates can be conducted by both internal and external auditors to evaluate compliance. The integrated management system checklist helps audit 3 international management system standards which are ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018.
- Operational audit – this operational audit checklist is utilized on mainline aircraft. The ISO 22000 audit checklist earlier is also a form of an operational audit.
- Compliance audit – this GMP checklist helps audit manufacturing processes and adherence to protocols and standards. It includes factors for quality control such as packaging, labeling, sanitation, documentation, and quality goals.
- Information System audit – A risk-based information system audit checklist to help assess potential dangers on cyber security. This also includes audits for security policies and plans.
Create Your Own Digital Audit Template
Eliminate manual tasks and streamline your operations.
As an internal audit software, SafetyCulture (formerly iAuditor) is a digital tool utilized by internal auditors and officers to conduct audits of business operations and assess safety compliance. SafetyCulture is used by internal auditors to:
- Streamline the internal auditing process
- Identify weak areas, inaccuracy, and non-compliance
- Create corrective action
- Keep records of audits
- Perform Audits Efficiently with SafetyCulture
Free Audit Program Templates from SafetyCulture
Get started with your audit plan by using pre-made templates you can customize and use on SafetyCulture. This free collection of audit program templates includes safety audit checklists to help you determine any issues regarding safety in the workplace, keep it updated, and take action on areas for improvement.
- View Audit Program Templates

SafetyCulture Staff Writer
SafetyCulture Content Team
The SafetyCulture content team is dedicated to providing high-quality, easy-to-understand information to help readers understand complex topics and improve workplace safety and quality. Our team of writers have extensive experience at producing articles for different fields such as safety, quality, health, and compliance.
In this article
Relevant articles, employee engagement.
Employee engagement may be influenced by various factors such as workplace culture, leadership, and ...
Journey Management
In this guide, you will learn what journey management is, why it’s important, and the most ...
Process Analysis
Benefits Business process analysis is consequential to a company’s growth. Whether you work as a ...

Related pages
- End of Shift Report
- Contract Review Checklist
- Log Sheet Template
- Order Form Template
- Knowledge Management
- Records Lifecycle
- Records Management
- Product Traceability
- Recordkeeping
- Records Management Software
- Task Management Software
- Corporate Social Responsibility Software
- Warehouse Management Software
- Employee GPS Tracking
We use cookies to provide necessary website functionality and improve your experience. To find out more, read our updated Privacy Policy .
Home / Resources / Insights and Expertise / Audit Programs and Tools
Audit programs and tools, take on audit and assurance assignments with confidence., search isaca's expert-designed programs and tools to find the right approach for your organizational needs..

Featured Audit Program
Ransomware readiness audit program.
Common governance, security, audit and assurance practices and processes can be employed to establish a foundational capability to respond to a ransomware incident. While there are unique elements to consider for each ransomware attack, there are common steps that can be employed. The Ransomware Readiness Audit Program is designed to assist senior management, auditors, and information/cybersecurity practitioners with resources to support readiness efforts.
- Audit Programs and Tools
- Audit & Assurance
- Emerging Technology
- Information Security
- Information Technology
Credentials
- CERTIFICATE
- CERTIFICATION
- COBIT® 2019
- CSX TECHNICAL FOUNDATIONS
- CYBERSECURITY FUNDAMENTALS
- Artificial Intelligence
- Career and Leadership
- Certification Exam Prep
- Cloud Computing
- Credentialing Certification
- Cybersecurity
- Data Governance
- Data Science
- Digital Transformation
- Digital Trust
- Emerging Technologies
- Internet of Things
- Network Infrastructure
- Public Affairs
- Remote Work
- She Leads Tech
- Software Development
- Threats and Controls
- Vendor Management
- Young Professionals
- Brazilian Portuguese
- Chinese Simplified
- Chinese Traditional
16 of 64 Results

Audit Program
Cobit for devops audit program | digital | english.
ISACA developed this audit program as a companion to COBIT Focus Area: DevOps, Using COBIT 2019. The focus area publication describes how COBIT framework concepts apply to DevOps and is intended to help enterprises evaluate management practices important to the development of an effective governance system over DevOps.

Ransomware Readiness Audit Program | Digital | English
Common governance, security, audit and assurance practices and processes can be employed to establish a foundational capability to respond to a ransomware incident.

Identity and Access Management Audit Program | Digital | English
The ISACA Identity and Access Management Audit Program provides specific testing and evaluation criteria to assist auditors in assessing the adequacy of safeguards in place to mitigate IAM risks.

Shadow IT Audit Program | Digital | English
The objective of the Shadow IT Audit Program is to provide management with an evaluation of how effectively shadow IT is being governed, monitored and managed.
FREE to ISACA Members: Join Now

ICQ and Audit Program for PCI DSS | Digital | English
This document provides the following PCI DSS assurance tools: Internal controls questionnaire (ICQ) that assists enterprises with defining the scope of the assurance engagement and can be used during the exploration period of an audit. Audit/assurance program for conducting a PCI DSS Compliance Program assessment, as described in chapter 14 of the A Practical Guide to the Payment Card Industry Data Security Standard (PCI DSS) book.

Secure Shell Protocol (SSH) Audit Program | Digital | English
Provides enterprises with a means to assess the effectiveness of their use of the SSH protocol, including key management and applicable SSH controls.

Cybersecurity: Based on the NIST Cybersecurity Framework Audit Program | Digital | English
Objective: To provide management with an assessment of the effectiveness of cyber security identify, protect, detect, respond, and recover processes and activities. The audit program is based on the NIST Cyber Security Framework.

European Cybersecurity Audit Program | Digital | English
As part of the ISACA European Cybersecurity Implementation Series, this audit program provides management with an impartial and independent assessment relating to the effectiveness of cybersecurity and related governance, management and assurance, with a focus on cybersecurity standards, guidelines and procedures as well as on implementation and governance of these activities.

Security, Audit and Control Features SAP ERP 4th Edition, Audit Program/ICQ's | Digital | English
This set of new audit/assurance programs and ICQs complements the book Security, Audit and Control Features SAP ERP, 4th Edition.

Voice Over Internet Protocol (VOIP) Audit Program | Digital | English
A typical VoIP network comprises a complex series of cooperating protocols, networks (wireless and wired), servers, security architectures, special services (such as E-911), backup and recovery systems, and interfaces to the PSTN.

VMware Server Virtualization Audit Program | Digital | English
The VMware server virtualization audit review will provide management with an independent assessment of the effectiveness of the configuration of, controls over and security of the virtualized servers operating under VMware in the enterprise’s computing environment.

UNIX/LINUX Operating System Security Audit Program | Digital | English
The objective of the UNIX/LINUX Audit program is to provide management with an independent assessment relating to the effectiveness of configuration and security of the UNIX/LINUX operations systems with the enterprise’s computing environment.

Microsoft Windows File Server Audit Program | Digital | English
The File Server Audit review provides management with an independent assessment of the effectiveness of the configuration and of the security of the enterprise’s file servers.

Microsoft SQL Server Database Audit Program | Digital | English
The Microsoft® SQL Server® Database Audit Program is designed to provide a relatively complete guide to the audit of SQL Server. This Audit program focuses on configuration of the relevant Microsoft SQL Server database implementations.

Microsoft SharePoint 2010 Audit Program | Digital | English
SharePoint is a group of Microsoft architectures with a common purpose—to provide sharing and retention of data in various forms. The audit of SharePoint differs from a routine audit of an application or a technology.

Microsoft Exchange Server 2016 Audit Program | Digital | English
While email may be the functionality that most users identify when thinking of Microsoft Exchange, the pairing of Exchange with clients such as Microsoft Outlook has broadened Exchange’s functionality beyond email.

Microsoft Exchange Server 2010 Audit Program | Digital | English
Exchange Server 2010 is comprised of a series of cooperating processes that communicate with one another on local and remote computers, as well as with domain controllers, and a number of different clients.

IPv6 Security Audit Program | Digital | English
The major objectives of the IPv6 networking audit review are to: Provide management with an independent assessment of the effectiveness of the IPv6 network’s architecture, security and alignment with the enterprise’s networking and IT security policies and architecture.

Microsoft Internet Information Services (IIS) 7 Web Services Server Audit Program | Digital | English
Objective—The Microsoft IIS 7.x Audit review provides management with an independent assessment of the effectiveness of the configuration and of the security of the IIS servers in the enterprise’s computing environment.

Network Perimeter Security Audit Program | Digital | English
The objectives of the network perimeter security audit review are to: Provide management with an independent assessment relating to the effectiveness of the network perimeter security and its alignment with the IT security architecture and policy. Provide management with an evaluation of the IT function’s preparedness in the event of an intrusion. Identify issues which affect the security of the enterprise’s network.

Identity Management Audit Program | Digital | English
The Identity Management Audit review will provide management with an independent assessment relating to the effectiveness of identity management and its policies, procedures and governance activities. The review will focus on IdM standards, guidelines and procedures as well as on the implementation and governance of these activities.

Cybercrime Audit Program | Digital | English
The objective of the audit review is to provide management with an independent assessment relating to the effectiveness of cybercrime prevention, detection and incident management processes, policies, procedures and governance activities.

IT Business Continuity Audit Program | Digital | English
Maintaining operations in the face of incremental changes as well as sudden disruption is an enterprise-wide goal that is facilitated through business continuity programs. Given the requisite participation of all operational functions across the organization in these programs, IT audit has an opportunity to leverage its detailed knowledge of the enterprise’s applications and systems and business operations.

Blockchain Framework Audit Program | Digital | English
The adoption of blockchain by diverse industries such as health care and real estate has effectively diminished blockchain's strong association with cryptocurrency. These industries, like so many others, decided to leverage the enhanced security, traceability, and efficiency that blockchain offers.

Azure Audit Program | Digital | English
In a cloud provider market comprised of solid frontrunners such as Amazon Web Services (AWS) and Microsoft Azure (Azure) as well as newcomers, auditors have a dual challenge: having familiarity with leading cloud computing platforms while keeping pace with cloud trends.

Amazon Web Services (AWS) Audit Program | Digital | English
The primary purpose of the Amazon Web Services (AWS) Audit Program is to provide a means for organizations to evaluate their deployments of AWS. This assessment facilitates assurance that the configuration and maintenance of AWS services support business objectives.

Windows Active Directory Audit Program | Digital | English
The Active Directory audit review will: Provide management with an evaluation of the Active Directory implementation and management security design effectiveness. Provide management with an independent assessment of the operating effectiveness of the security controls.

MySQL Server Audit Program | Digital | English
The objective of the MySQL Server Security Audit review is to provide management with an independent assessment relating to the effectiveness of configuration and security of MySQL Servers within the enterprise’s computing environment.

Social Media Audit Program | Digital | English
The objective of the social media Audit review is to provide management with an independent assessment relating to the effectiveness of controls over the enterprise’s social media policies and processes.

Personally Identifiable Information (PII) Audit Program | Digital | English
The Personally Identifiable Information (PII) Audit review will: Provide management with an assessment of PII policies and procedures and their operating effectiveness. Identify internal control and regulatory deficiencies that could affect the organization.

z/OS Security Audit Program | Digital | English
The objective of the z/OS Audit review is to provide management with an independent assessment relating to the controls addressing the configuration and security of the z/OS operations systems with the enterprise’s computing environment.

Outsourced IT Environments Audit Program | Digital | English
The practice of outsourcing IT has experienced consistent growth for several years. Enterprises are choosing to concentrate on their core capabilities, cost reduction and the ability to tap into specialized resources.

Mobile Computing Security Audit Program | Digital | English
The mobile computing security Audit review will provide management with an assessment of mobile computing security policies and procedures and their operating effectiveness.

IT Strategic Management Audit Program | Digital | English
The objectives of IT strategic management can be twofold: A component of an IT general controls review. Operational audit of the IT function.

IT Tactical Management Audit Program | Digital | English
The objectives of the IT tactical management can be twofold: A component of an IT general controls review. Operational audit of the IT function.

Information Security Management Audit Program | Digital | English
The information security management audit review will: Provide management with an assessment of the effectiveness of the information security management function. Evaluate the scope of the information security management organization and determine whether essential security functions are being addresses effectively.

IT Risk Management Audit Program | Digital | English
IT audit and assurance professionals are expected to customize this document to the environment in which they are performing an assurance process. This document is to be used as a review tool and starting point.

Generic Application Audit Program | Digital | English
The objectives of the applications review are to: Provide management with an independent assessment of efficiency and effectiveness of the design and operation of internal controls and operating procedures. Provide management with the identification of application-related issues that require attention.

eCommerce & Public Key Infrastructure Audit Program | Digital | English
The major objectives of the e-commerce/PKI Audit review are to: Provide management with an independent assessment of the effectiveness of the architecture and security of the e-commerce and PKI environments and their alignment with the enterprise's IT security policies and architecture and with industry good practices.

Systems Development and Project Management Audit Program | Digital | English
The objectives of the systems development and project management audit/ assurance review are to: Provide management with an independent assessment of the progress, quality and attainment of project/program objectives at defined milestones within the project/program.

Change Management Audit Program | Digital | English
Objective: Perform a review of the change management process to provide management with assurance that the process is controlled, monitored and is compliance with good practices. Format: ZIP

Cloud Computing Management Audit Program | Digital | English
Objective—Provide stakeholders with an assessment of the effectiveness of the cloud computing service provider’s internal controls and security, identify internal control deficiencies within the customer organization and its interface with the service provider and provide audit stakeholders with an assessment of the quality of and their ability to rely upon the service provider’s attestations regarding internal controls.

BYOD Audit Program | Digital | English
Objective: Provide management with an assessment of BYOD policies and procedures and their operating effectiveness, identify internal control and regulatory deficiencies that could affect the organization and identify information security control concerns that could affect the reliability, accuracy and security of the enterprise data due to weaknesses in mobile computing controls.

Physical and Environmental Security Audit Program | Digital | English
Cybersecurity and audit practitioners may talk in terms of physical security being a part of cybersecurity or physical security being a subset of cybersecurity.

Database Audit Program | Digital | English
Databases, comprised of data and database management systems, store data so that they can be used by different programs without concern for the data structure or organization.

VPN Security Audit Program | Digital | English
Virtual Private Networks (VPNs) are relied on to give remote workers access to the corporate network securely. As the number of remote workers and the duration of remote work have increased (from remote working being temporary to potentially permanent), awareness of VPNs has grown.

CASB Audit Program | Digital | English
With increased adoption of cloud services, enterprises have shown an interest in leveraging the flexibility and agility offered by cloud platforms. Along with those advantages, however, comes the need to consider potential risks such those associated with the various deployment models, identity management, and compliance with data drive regulations to which the enterprise is subject.

Biometrics Audit Program | Digital | English
The review will focus on the acquisition, architecture, rollout and security of biometric technologies, both the deployed and planned, including, but not restricted to, policies, standards and procedures, as well as resilience to major outages, intrusions or other failures.

Apache Web Services Server Audit Program | Digital | English
The objective of the Apache Web Services Server Audit review is to provide management with an independent assessment relating to the effectiveness of configuration and security of Apache Web Servers within the enterprise’s computing environment.

CIS Critical Security Controls Audit Program | Digital | English
The objective of a cyber security audit is to provide management with an evaluation of the effectiveness of cyber defense, with a focus on the most fundamental and valuable actions that each organization should take.

California Consumer Privacy Act (CCPA) Audit Program | Digital | English
One of the challenges that auditors face with compliance initiatives is providing assurance as expectations change. Data privacy is no exception. In the U.S., while some states have passed consumer privacy laws, remaining states have taken action ranging from creating data privacy task forces to having legislation in committee.

GDPR Audit Program for Small and Medium Enterprises | Digital | English
As of 25 May 2018, GDPR gives EU residents control over their personal data wherever in the world they or their data may reside. It not only standardizes regulation across the EU and the European Economic Area (EEA); GDPR also affects all enterprises that process data from EU/EEA countries.

Data Privacy Audit Program | Digital | English
As corporations, governments, and non-profits identify and implement innovative ways to use data, their responsibilities for ensuring appropriate safeguards over the collection, storage, and purging of the data may be challenged.

HIPAA Audit Program | Digital | English
The Health Insurance Portability and Accountability Act (HIPAA) was created to provide privacy and security for protected health information (PHI). While HIPAA provides covered entities with standards for safeguarding PHI, the Health Information Technology for Economic and Clinical Health Act (HITECH) also plays a role in the security of PHI through its establishment of breach notification requirements.

Software Assurance Audit Program | Digital | English
The Software Assurance Audit Program provides management with an evaluation of the effectiveness of software assurance governance, development process and methodology, verification and review, and deployment of the softwareend-product.

Windows File Server Audit Program | Digital | English
The objective of the Windows File Server Audit Program is to ensure data confidentiality, integrity and availability around the enterprise’s server practices. Assessment of the controls around Windows File Servers facilitates assurance that identification and resolution of server vulnerabilities support business objectives.

Mobile Computing Audit Program | Digital | English
The Mobile Computing Audit Program helps you assess the effectiveness of the controls around risk associated with mobile computing. Through a mobile computing audit, IT auditors can assess their organizations’ practices around areas such as remote access, data loss and malware.

Application Containers Audit Program | Digital | English
With application virtualization, the number of applications in the hosted environment can be increased without a corresponding increase in the number of servers.

Blockchain Preparation Audit Program | Digital | English
As blockchain is still an emerging technology, there is not yet a published uniform auditing standard. However, this program is intended to help organizations identify and develop key policies, procedures and controls to mitigate risk and streamline processes.

Security Incident Management Audit Program | Digital | English
Unplanned incident preparation for many enterprises includes business continuity programs, disaster recovery plans and information security strategies. While looking at some of the same elements as these incident preparation tactics – namely the security triad of confidentiality, integrity, and availability – security incident management differs in that it poises enterprises for the identification and analysis of threats or incidents.

Microsoft SQL Server 2016 Audit Program | Digital | English
With GDPR and data privacy initiatives currently the focus of many enterprises, now might be a good time to take a new look at existing opportunities to incorporate features that protect sensitive and confidential data.

GDPR Audit Program Bundle | Digital | English
The GDPR audit program bundle offers a holistic framework for reviewing all data-processing practices in the context of GDPR.

Biometrics Audit Program | Digital | French
The primary objectives of the biometric audit/assurance review are to: Provide management with an independent assessment of the effectiveness of the architecture and security of the deployed biometric systems and their proper alignment with the enterprise’s IT security policies, information systems architecture, information asset criticality and industry good practices.

Blockchain Framework Audit Program | Digital | Chinese
区块链在医疗保健、房地产等各类行业中的应用,已经有效弱化了区块链和加密货币之间的紧密关联
Custom Training Programs
Looking to train your team? We can customize virtual training and certification programs for every need.
Get Started
Quick Links
- Publications
- White Papers
- Engage Online Community
- Industry News
- ISACA Now Blog
- ISACA Podcasts
- Call for Case Studies

An official website of the United States government
The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.
The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.
Banker Resource Center
Internal and External Audit Programs
Each institution should have an internal audit program that is appropriate to its size and the nature and scope of its activities. When properly structured and conducted, internal audit programs provide vital information about risks and controls so management can promptly address any identified weaknesses. An external auditing program complements the internal auditing function by providing management and the board of directors with an independent and objective view of the reliability of the institution's financial statements and the adequacy of its financial reporting internal controls.
Laws and Regulations
Key laws and regulations that pertain to FDIC-supervised institutions; note that other laws and regulations also may apply.
- Section 39 of the FDI Act — Standards for Safety and Soundness as implemented by Appendix A to Part 364 — Interagency Guidelines Establishing Standards for Safety and Soundness provides operational and managerial standards for safety and soundness to include internal controls, information systems, and internal audit systems in accordance with Section 36 of the FDI Act — Early Identification of Needed Improvements in Financial Management
- Section 36 of the FDI Act — Early Identification of Needed Improvements in Financial Management as implemented by Part 363 — Annual Independent Audits and Reporting Requirements discusses annual independent audit and reporting requirements for insured depository institutions with total assets of $500 million or more — note that Section 36 of the FDI Act and Part 363 apply to all FDIC-insured institutions
- Summary of Part 363 reporting requirements
- For questions concerning Part 363, please contact us at [email protected]
Supervisory Resources
Frequently asked questions, advisories, statements of policy, and other information issued by the FDIC alone, or on an interagency basis, provided to promote safe-and-sound operations.
- Section 4.2 — Internal Routine and Controls of the Risk Management Manual of Examination Policies addresses the function and key components of internal control programs as well as internal and external audit programs, and describes examination processes used to assess effectiveness
- Interagency Policy Statement on the Internal Audit Function and its Outsourcing outlines key characteristics of the internal audit function and discusses the use of outsourcing arrangements and the effect on independence of an external auditor who also provides internal audit services to an institution
- Interagency Policy Statement on External Auditing Programs of Banks and Savings Associations outlines the characteristics of an effective external auditing program and provides examples of how an institution can use an external auditor to help ensure the reliability of its financial reports
- Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters informs financial institutions’ boards of directors, audit committees, and management that they should not enter into agreements that incorporate unsafe and unsound external auditor limitation of liability provisions
- Interagency Policy Statement on Coordination and Communication Between External Auditors and Examiners provides guidelines for information that should be provided by depository institutions to their external auditors and meetings between external auditors and examiners in connection with safety and soundness examinations
- Interagency Advisory on External Audits of Internationally Active U.S. Financial Institutions describes prudent considerations for incorporating the principles and expectations in the Basel Committee on Banking Supervision external audit guidance
- Statement on Part 363 Annual Reports in Response to the Coronavirus provides additional information and guidance to insured depository institutions subject to Part 363 that have been affected by the Coronavirus Disease 2019 (referred to as COVID-19)
- Electronic Filing of Part 363 Annual Reports and Other Reports and Notices provides insured depository institutions subject to Part 363 the option to file the annual reports and other reports and notices required under Part 363 electronically through the FDIC's secure website, FDIC connect (FCX), rather than in paper form
- Rescission of Statement on Part 363 Annual Reports in Response to the Coronavirus which provided an additional 45 days for insured depository institutions (IDIs) subject to Part 363 of the FDIC’s regulations to file their Part 363 Annual Reports and Other Reports and Notices
Other Resources
Supplemental information related to safe-and-sound banking operations.
- The American Institute of CPAs represents the Certified Professional Accountant (CPA) profession nationally regarding rule-making and standard-setting, and serves as an advocate before legislative bodies, public interest groups and other professional organizations
- The U.S. Securities and Exchange Commission protects investors, maintains fair, orderly, and efficient markets, and facilitates capital formation
- The Public Company Accounting Oversight Board establishes auditing and related professional practice standards for registered public accounting firms to follow in the preparation and issuance of audit reports
- The Committee of Sponsoring Organizations of the Treadway Commission provides thought leadership through the development of comprehensive frameworks and guidance on enterprise risk management, internal control, and fraud deterrence designed to improve organizational performance and governance, and to reduce the extent of fraud in organizations
- Assessment Management
- Compliance Audits
- Enterprise Risk Management
- Fraud Risk Management
- IT Risk Management
- Operational Audits
- Operational Risk Management
- Security Compliance Management
- SOX Compliance
- SOX Readiness
- Vendor Risk Management
- Business Services
- Education, Government, and Non-Profit
- Energy, Materials, and Utilities
- Financial Services
- Manufacturing
- Media and Telecom
- Real Estate and Construction
- Travel and Transportation
- Technology & Security
- Resource Library
- AuditBoard TV
- Events & Webinars
- On-Demand Webinars
ESG Audit Checklist and Best Practices for 2022

Environment, Social, and Governance (ESG) is a framework for assessing risks to a company’s operations related to large-scale, long-term environmental, social, and governance issues. ESG covers a wide range of issues, from environmental threats like climate change, to social issues related to diversity, equity, and inclusion, to social responsibility in investing and production, to governance issues related to executive pay and financial reporting. These risks, however, are also opportunities for growth – to become the ethical, inclusive, and sustainable workplaces that not only manage risk, but proactively increase their stakeholders’ quality of life. An ESG audit will also substantiate the accuracy of any ESG-related data your organization discloses to employees, stakeholders, and regulatory entities. Read on to learn more about what an ESG audit entails, and download our preliminary ESG audit checklist below.
What Is an ESG Audit?
An ESG audit is an assessment of the risks an organization faces related to environmental, social, and governance domains. ESG audits can be internal or external; KPMG suggests that third-party auditors and assurance specialists who are well-versed in ESG assessments will become increasingly important for companies who wish to assure their stakeholders that their ESG claims are accurate. An ESG audit will likely align with other dimensions of your risk management plan and compliance requirements, as well, and can prepare you to file reports with regulatory agencies. As Deloitte notes, internal audit’s “role includes validating the effectiveness of ESG-related controls and activities to help organizations manage those risks and foster resilience.”
What Is an ESG Risk?
ESG risks are exactly what the acronym lists – environmental, social, and governance risks. While some argue that the “G” in ESG should be considered separately, these three risk categories are interdependent. We may well see the acronym for ESG evolve in the future, but the SEC’s move to prioritize climate-related disclosures may be a precursor to regulations that codify ESG to law. Most ESG specialists see governance issues, which include board quality and executive pay transparency, as important to managing both environmental and social risk. Here’s a bit more detail about each category:
- Environmental risk includes potential for pollution of the air, water, or soil due to production or distribution of goods, climate impact, carbon footprint, and energy use.
- Social risk includes risk to the well-being, reputation, or privacy of one’s customers, employees, or supply providers, including accessibility in the design and distribution of goods, employee welfare, human capital, and issues related to diversity, equity, and inclusion (DEI).
- Governance risk includes issues related to financial reporting, fraud prevention, executive pay, and organization of the company.
Top Four ESG Issues in 2022
ESG is a hot topic and the top ESG issues in 2022 include the following four categories:
#1: Climate Change and Sustainability
Climate issues pervade corporate operations, from the sustainability of production choices and mining of raw materials to companies’ investments. Climate change is one of the biggest concerns for consumers, especially Gen Z. And the SEC is concerned as well – when the U.S. Securities and Exchange Commission solicited public input early in 2022, 75% of 550 individual responses supported mandatory climate disclosures in financial reporting. Sustainability audits are often separate from ESG audits, but they overlap significantly – the main difference is that sustainability audits are often internal and organizations are left to create their own definitions, while ESG frameworks are more specific and standardized.
#2: Diversity, Equity, and Inclusion
DEI initiatives have gained momentum in recent years, along with an increasing consumer focus on the social responsibility of the companies they support. Companies are increasingly held accountable for their actions to attract, recruit, and retain employees from diverse backgrounds. There have also been imperatives for transparency in pay structures to expose pay gaps, and a push for human resources and internal communications specialists to explicitly address how systemic inequality impacts hiring decisions and the employment history of industries. Stakeholders have increasing concerns that the organizations they support and work for are socially responsible both internally and externally.
#3: Supply Chain Issues
In 2022, supply chain issues became part of the daily news in ways we have rarely seen, with impacts rippling across industries. Supply chain issues not only halt the rotation and manufacturing of goods for consumers, they also impact those working in production facilities and transportation. A good ESG audit will help to predict the relationship between future catastrophes — natural or human-made — and supply chain problems.
#4: International Conflict
Whether stakeholders are concerned about the volatility of war or human-rights issues in various parts of the world, international conflict can exacerbate markets and make stakeholders wary of investing in a company’s assets. ESG auditing will examine risks related to expansion into international markets, either through business acquisitions or outsourcing. Europe- and US-based companies have faced pressure to pull their business operations out of Russia in light of the war in Ukraine, for example. ESG audits consider the risks of running business operations in parts of the world that could become volatile.
ESG Audit Checklist
ESG audits are dependent on the maturity of the organization putting them into practice, the type of product manufactured or service rendered, and the social context of your organization. An ESG audit will help to determine the specific moves your company needs to take to shut down risks and capture opportunities most relevant to its goals. An ESG audit will also verify the accuracy of your ESG-related disclosures. Download our ESG Audit Checklist are some best practices to help you identify ESG risks and establish ESG controls.

#1: Inventory and Interview Your Stakeholders
Preparation for an ESG audit includes informing stakeholders and getting a grasp of what they care about. For example, say your company is interested in branching into NFTs, but your employees and customers are concerned about the energy expenditure. In collecting and analyzing stakeholder perspectives, your organization will be better informed about ESG risks, as well as the potential benefits and detriments of your company’s investment decisions.
#2: Incorporate ESG Into Your Overarching Risk Management Plan
As you develop or revise your organization’s risk management plan, you’ll want to consider how ESG risks and opportunities intersect with other types of risks. Take stock of your risks and opportunities and use your stakeholders’ answers to help you keep track of ESG risks that may not have shown up in your initial drafting; a report from Deloitte Ireland promotes full integration of ESG into risk management plans, concluding that “future developments in regulation, an increase in ESG expertise in the industry and resulting improvements in available data should lead to the ongoing maturity of firm’s ESG risk management capabilities.”
#3: Determine Which Compliance Requirements Overlap With ESG
Depending on the scope and maturity of your company, you will likely already have numerous compliance requirements related to ESG. For example, if your company is seeking compliance with Sarbanes-Oxley (SOX), you’ll already have a plan for financial reporting in place and will already be reporting to the SEC; integrating climate-related disclosures into that report will save you time and energy. The International Organization for Standardization (ISO) also has numerous ESG-related standards, like ISO 14001 for Environmental Management Systems and ISO 45001 for Occupational Health and Safety, which provide strategies for protecting the environment and human capital. ISO recently created a committee (ISO/TC 322) to focus solely on ESG in the coming years.
#4 Choose Your ESG Guidance Frameworks
Whether you’re doing an internal audit or selecting a third-party auditor to evaluate your ESG risks, you will need to choose one or more ESG frameworks that work well for your company and its goals. Two of the most popular frameworks are put out by the Sustainability Accounting Standards Board ( SASB ) and the Task Force on Climate-Related Financial Disclosures ( TCFD ), with the Global Reporting Initiative ( GRI ) coming up as a close third. SASB provides broader sector-specific guidelines on a range of ESG risks, while TCFD is more specifically geared towards climate issues. The framework you choose should fit your specific industry and align with your overarching risk management strategy.
#5: Prepare for ESG Reporting
ESG reporting may already be familiar to your organization since the SEC requires that publicly-traded companies submit annual reports on human capital resources (HCR). The SEC is in the process of implementing stronger regulations regarding climate-related disclosures in financial reporting. Companies should expect ESG reporting to become increasingly complex in the future. Your ESG audit should include a plan for reporting your ESG risks and strategies to your stakeholders and any regulatory entities. Those reports, in turn, will substantiate that the data you are reporting is accurate, complete, and transparent and that your company’s core values and commitments are authentic.
Overcoming Top ESG Program Challenges
Whether you are driven by your company’s core values or you aim to streamline reporting to the SEC, your ESG strategy should be well aligned with your risk management plan and designed to take the best advantage of your sector’s opportunities for growth. Leading organizations have found that their biggest challenges with managing an effective ESG program include:
- Centralizing all ESG initiatives, claims, and metrics in one system of record.
- Evidence collection to substantiate the organization’s progress towards those public claims and metrics.
- Mapping ESG metrics relevant framework(s) such as SASB, TCFD, and GRI.
- Aggregating data from disparate systems such as carbon emission calculators, HR systems, and Finance systems to improve auditability.
- Responding to Rating Agency questionnaires (MSCI, S&P Global, CDP, ISS).
- Consolidating results for ESG reporting purposes, whether into stand-alone ESG reports or as part of broader annual disclosures.
If your organization is looking to start or accelerate your ESG journey, implementing connected risk management software can help your organization get on the right footing going forward to manage and track the ESG life cycle from end to end.
Related Articles

Ready to Get Started?
Get Access to ALL Templates & Editors for Just $2 a month.

- Google Docs
- Apple Pages
- Illustrator (AI)
- MS Publisher
- Vectors (EPS)
- Google Sheets
- Apple Numbers
- Power Point
- Backgrounds
- Coloring Pages
- Illustrations
- Video Online
11+ Audit Program Templates in PDF | DOC
Audits are objective evaluations of the financial statement s of an organization. In an audit program, it is an important tool to ensure accuracy in the represented transactions of the body. It is either done by the employees of the organization internally or externally by an outside body.

Table of Content
1. audit of fixed assets audit program template, 2. sample audit program template, 3. general audit program template, 4. strategic audit program template, 5. audit communication program template, 6. simple audit program template, 7. annual audit program template, 8. environmental audit program template, 9. audit program template in pdf, 10. attorney audit program template, 11. audit program template in doc, 12. audit program template, 13. audit of fixed assets audit program template, how to develop an audit program report tactfully, what is the primary factor essential in holding an audit program, what are the factors considered for conducting an auditor evaluation, why is an office audit essential while making a complete audit program, creating an audit report for office.

Final Report
Follow-up report, evaluating the performance, check impartiality, review of internal auditing, check the scope, critical appraisal, look out for dysfunctions, half-yearly assessment, step 1: provide an executive summary, step 2: authenticity of data, step 3: do the categorization, step 4: learn about the components, step 5: make a checklist, more in audit templates.

18+ FREE & Premium Audit Plan - Download NOW
Beautifully Designed, Easily Editable Templates to Get your Work Done Faster & Smarter.


- May 31, 2021
Accounts Payable Audit Work Program
Updated: Jun 1, 2021
Example Internal Audit Work Program / Risk and Control Matrix (RCM)

Maintaining appropriate controls over an accounts payable process, such as ensuring invoices are only paid when a valid three way match is completed and appropriate approval is received, is important to ensure there is no fraud, the business is meeting any local regulatory requirements and the business is making best use of its available cash flow.
We have developed a generic Internal Audit Work Program, or Risk and Control Matrix (RCM) aimed at helping audit teams ensure controls over the accounts payable process have been designed and implemented correctly, and are also operating effectively.
The testing work program is built within our example 'Excel' audit file. The test plan has also been mapped to an example audit scope and objectives, and includes example risks and controls. See below for an extract from the example work program file.
To view a free version of this template, please click here .
To purchase a copy of this template, please click here .
Want all of our templates? Become a member . Members can access all of the templates from the members area here .
As always, this is a generic template. You should review this template in detail and edit accordingly so it is suitable for your business.
#InternalAudit #Audit #WorkProgram #Program #Example #Review #ExampleReview

- Tools and Templates
- Risk management and governance
audit program (audit plan)
- Ben Lutkevich, Technical Features Writer
- Ben Cole, Executive Editor
- Aislyn Fredsall
What is an audit program?
An audit program, also called an audit plan, is an action plan that documents what procedures an auditor will follow to validate that an organization is in conformance with compliance regulations .
The goal of an audit program is to create a framework detailed enough for any outside auditor to understand. It should contain the following information:
- the official examinations that have been completed;
- conclusions reached; and
- the reasoning behind each conclusion.
The framework explains the audit's objectives, scope and timeline. The audit program should also describe how working papers -- the documented audit evidence -- will be collected, reviewed and reported.
Objectives of audit programs
When developing an audit program , the internal auditor and the associated audit team members should first outline the audit's objectives, goals and obligations.
Audit program objectives help direct planning of the audit report and are based on the policies, procedures and guidelines unique to the company. These objectives may relate to how the audit committee will maintain efficiency, professionalism and a specific code of conduct during the audit procedure.
In addition to relevant regulatory compliance mandates, objectives for audit programs should consider and incorporate the following:
- management priorities
- business intentions
- system requirements
- business structure
- legal and contractual mandates
- customer and other interested parties' expectations
- risk management vulnerabilities
- corrective actions from previous audits

Preparing an audit program
Audit program details are based on an organization's unique needs. Plan preparation will consider the relevant regulatory deadlines, staff requirements, the reporting structure and overall goals.
Audit goals take into account how a company will maintain regulatory compliance using risk assessment and management procedures. The audit program also includes a timeline detailing when specific aspects of the program take place and how to prioritize them.
Audit program planning is usually a continual and iterative process. During planning and development, companies build on lessons learned from previous audits. They also implement new best practices that alleviate risk and maintain compliance.
Audit development guidelines and best practices vary by industry. Local and regional auditing certifications are available, as are internationally recognized ones, such as the following:
- the Certified Internal Auditor designation offered by the Institute of Internal Auditors;
- the Certified Information Systems Auditor designation offered by the Information Systems Audit and Control Association; and
- International Register of Certificated Auditors membership.
Types of audit programs
A number of different types of audit programs exist.
Standardized audit programs
These audit programs are available for many different industries and are used proactively to help organizations create their own internal compliance framework and internal audit program.
For example, the International Federation of Accountants publishes financial audit standards called the International Standards on Auditing. A standardized audit program is different from a fixed audit program, which is defined as an audit program that cannot be changed during the course of an audit.
Tailored audit programs
Tailored audit programs incorporate procedures designed to match the needs of the auditing entity. These programs are customized to reference specific areas, such as business procedures, financial statements, legal documents and assets. Tailored programs target specific requirements, letting companies more easily identify compliance lapses and develop internal controls to offset them.
Compliance audit programs
A compliance audit program outlines how an organization adheres to regulatory guidelines. The details of these programs vary, depending on whether an organization is public or private, what kind of data it handles, if it transmits or stores sensitive financial data and similar factors. Audit programs can be internal or external audits. Compliance audits are often carried out by an external auditor.
The following are examples of compliance audit programs:

- The Sarbanes-Oxley Act requires that electronic communication be backed up and secured with disaster recovery infrastructure.
- The Payment Card Industry Data Security Standard ( PCI DSS ) mandates financial services companies that transmit credit card data to comply with its requirement.
- Publicly traded U.S. companies must report results of internal control audits to the Securities and Exchange Commission .
Advantages of an audit program
Audit plans offer advantages related to the following aspects of an audit.
- Scope. A preestablished plan limits the scope of the audit work.
- Cost effectiveness. A plan also limits the overall costs of an audit.
- Communications. An established framework for carrying out an audit helps prevent misunderstandings between the client and auditor. Audit plans clearly communicate how the audit will be done, who the auditors are and when the audit will occur.
- Trust. Audit processes that are clearly stated and accounted for help the client trust the auditor will do the job correctly .
- Evidence. Audit plans help auditors obtain evidence for their findings.
- Efficiency. Plans help teams carry out work efficiently and mitigate potential problems.
Disadvantages of an audit program
Audit plans also have disadvantages and challenges.
- Generality. Some clients may have special needs that a preformatted audit strategy ignores or doesn't fully address. Revising the plan takes time and might undermine the client's trust in the auditor.
- Update. Strategies and standards that underlie an audit plan can go out of date and require the plan to be updated. For example, if the PCI Security Standards Council, or PCI SSC , changes PCI DSS compliance requirements, then audit plans surrounding the PCI DSS must be updated to encompass the changes.
- Rigidity. A plan sets goals and agreed-upon procedures for what the audit staff must accomplish. Audit staff may not be compelled to go beyond the requirements laid out in the plan or use procedures that don't apply to the plan's goals. They might also be discouraged from using creative or critical thinking when following the automated procedures in the plan.
IT general controls audits are a good place for organizations to start looking to take a broad survey of their IT capabilities. Explore this ITGC audit template and downloadable checklist to help assess various risks to IT operations and company infrastructure.
Continue Reading About audit program (audit plan)
How to conduct a cybersecurity audit based on zero trust.
- How to conduct an IoT audit for compliance
- What does your backup and recovery audit checklist need?
- Tips to prepare for a network disaster recover audit
- What is BCDR? Business continuity and disaster recovery guide
Related Terms
Dig deeper on risk management and governance.

SOC 3 (System and Organization Controls 3)

Tips to prepare for a network disaster recovery audit

security audit

Azure management groups, subscriptions, resource groups and resources are not mutually exclusive. Businesses can -- and often do ...
Amazon CodeGuru reviews code and suggests improvements to users looking to make their code more efficient as well as optimize ...
Establishing sound multi-cloud governance practices can mitigate challenges and enforce security. Review best practices and tools...
Configuration profiles make it easier to manage BYOD iPhones, but they're also associated with malware. Mobile security policies ...
User Enrollment creates a management profile for BYOD iPhones, but IT must remove that data in cases such as device loss or theft...
User Enrollment in iOS can separate work and personal data on BYOD devices. IT teams should learn how to enable it in Microsoft ...
Linux admins can use Cockpit to view Linux logs, monitor server performance and manage users. Use the tool to help admins manage ...
Hyperscale data centers can hold thousands of servers and process much more data than an enterprise facility. However, they can ...
Organizations that build 5G data centers may need to upgrade their infrastructure. These 5G providers offer products like virtual...
Project Risk Management Audit Work Program

This sample audit program provides the internal audit team with guidance and direction when executing audits of projects and/or program management office activities. This work program is intended to provide the audit team with an overview of some basic background and concepts associated with projects and programs, and the dependencies/relationships between them.
The work program is a menu of options from which to choose controls and work steps based on the scope (and risk) of a particular audit. The content of the work program should be customized and/or expanded to directly align with the objectives of your audit.
Related Resources
Project management risk key performance indicators (kpis), program management office initiative report, project management process: monitoring, scope changes, forecasting and contract closing process flow.
Sign up for a free, no-obligation trial to start exploring our timesaving, valuable resources.
Internal Audit Training, IT Audit Training Courses, Information Security Training - CPE Interactive
Continuing professional education for audit, assurance, & info security.
- CPEinteractive Certification Policies – Group Training
- CPEinteractive Certification Policies – Virtual Classroom
- Group Sponsored Training
- Partial List of Clients
- Norm Kelson
- Keith Barber
- Kevin Cardwell
- Mary Breslin
- Leighton Johnson
- Richard Tarr
- Corporate Training
- Professional Organization Training
- Auditor’s Hands-On Guide to CyberSecurity Vulnerability and Penetration Testing (CH13) – NEW
- Hands-On Audits of Windows Server and Active Directory (CH20) – NEW
- Hands-On Audits of DMZ Network CyberSecurity (CH11) – NEW
- Hands-On Audits of Network CyberSecurity (CH10) – New
- Auditing CyberSecurity of Wireless Networks (CY12)
- Auditing Windows Active Directory Services CyberSecurity (CY24)
- Auditing Windows Server CyberSecurity (CY23)
- Auditor’s Guide to CyberSecurity Vulnerability and Penetration Testing (CY13)
- Audits of Your Internet CyberSpace DMZ Network (CY11)
- CyberAuditing Your Software Supply Chain (CY44)
- CyberAudits of Remote Access and Mobile Computing (CY18)
- CyberSecurity Audits of Cloud-Native Applications (CY045)
- CyberSecurity Audits of MS Windows Server and Active Directory Security (CY20)
- CyberSecurity Audits of Web Applications – Legacy & Beyond (CY02)
- Intrusion Analysis and Incident Response (CY17)
- Linux as an Audit Target…and as an IT Audit Tool (CY22)
- Overview of Amazon Web Services Security and Controls (CY05)
- Simplifying Audits of Network CyberSecurity (CY10)
- Understanding and Auditing Cryptography for Cybersecurity Applications (CY41)
- Understanding Blockchain: The Underlying Technology for Trusted Transactions (CY50)
- Assessing Data Reliability (AA10)
- Auditors Guide to Big Data (AA25)
- Auditing Cloud Computing Security (AA24)
- Auditing CyberSecurity Governance (AA23)
- Auditing IT Outsourced Environments (AA06)
- Auditing Your CyberSecurity Program: Top to Bottom (AA28)
- Introduction to IT Auditing (AA01)
- One-Day Introduction to IT Audit (AA29)
- Planning and Conducting IT General Controls Reviews (AA03)
- A Guide to CyberSecurity Risk Assessment and Audit Priorities (AM08)
- Successfully Implementing and Managing Enterprise Risk Management (AM09)
Developing Results-Driven Audit Work Programs (AS07)
- Effective Identification and Testing of Internal Controls – (AS27)
- Effective Risk-Based Audit Planning and Execution – (AS28)
- Embedding Critical Thinking into the Internal Audit Process (AS18)
- Getting to the Root of the Matter: Root Cause Analysis Techniques for Auditors (AS23)
- Project Management Skills for Internal Auditors (AS29)
- Revisiting Risk Assessments After COVID (AS32) – NEW
- Building Credibility in Audit Through Effective Communication (AS31)
- Getting the Message Across: Writing Effective Concise Reports
- Interviewing Skills for Internal Auditors (AS24) – UPDATED
- Automating Data Analytics Scripts and Queries (DA03)
- Developing Effective Continuous Audits (DA04)
- Fundamentals of Data Analytics (DA02)
- Leveraging Data Analytics to Fight Fraud (DA05)
- Using Data Analytics to Improve Internal Audit (DA01)
- Catching the Bad Guys: Fraud Auditing for Internal Auditors (FR09)
- Conducting Fraud Risk Assessments Successfully (FR10)
- Financial Statement Fraud Analysis and Forensic Accounting (FR13)
- Fraud Risk After COVID-19 (FR14) – NEW
- Implementing a Fraud Awareness Program (FR11)
Course Description
Developing an audit work program can be a daunting process, especially when the audit area is one with which the auditor is unfamiliar, and/or has not been audited previously. This course will take the mystery and pain out of the process by introducing a methodology called “Closing the Loop Framework”. It provides a foundation for how to develop audit steps based on audit scope and the evidence required to achieve audit objectives. Less experienced auditors will learn how to build the audit program, and experienced auditors will have an opportunity to refresh their skill-set and consider the Closing the Loop Framework as a tool for improving audit quality. You will have the opportunity to build components of an audit program in a workshop. In this seminar, we will discuss the critical issues to be considered:
- Fundamental requirements for audit work programs referencing audit standards and generally accepted practices
- Planning performance, financial, compliance and IT audits
- Using the Closing the Loop Framework to ensure completeness and quality of the planning and audit execution process
- How well-developed audit work programs support the management and quality assurance of audits
Learning Objectives
- Gain an understanding of the role of the Audit Work Program
- Become familiar with Standards-based Requirements for Audit Work Programs
- Strengthen one’s skills in developing audit steps and audit work programs
- Understanding how Checklists and Internal Control Questionnaires can be used
Course Outline
Setting the Stage: The Role of Audit
- Defining audit evidence
- Impact of audit evidence on audit risk
- Requirements from auditing standards
- Audit charter
- Audit work plan vs. audit checklist
Audit Development Cycle
- Closing the Loop Process
Planning—Understanding the Business
- Identifying and understanding business objectives
- Document review
- Understanding the business processes
- Documenting business processes
Planning—Scope
- Defining scope—what’s in and what’s out
- Setting expectations with Management
- Scope statements
- Information gathering and fact finding
- Establishing rapport
- Whom to interview
- Interviewing approaches and styles
- Questioning styles and approaches
- Conducting the interview
- Interviewing rules and best practices
- Communication barriers
Engagement Risk Assessments
- Understanding risk
- Types of risks—operational/financial/reputational/regulatory
- Identifying risk
- Evaluating risk
- Prioritizing risk
- Likelihood/significance/duration/velocity
Identification of Controls
- Types of controls
- Control objectives
- Entity-level controls
- Activity-level controls
- Evaluating controls: design vs. operating effectiveness
Documenting Processes and Controls
- Flowcharts and process flows
- Walkthroughs
Developing Audit Objectives and Refining Scope
- Importance of linking Audit Objectives to Operational and Control Objectives
- Developing steps that add value
- Linking to business objectives
Additional Information
Who should attend.
Internal and external auditors
Learning Level
Intermediate
Group Live or Group Internet-Based
Advanced Preparation
Recommended prerequisites.
At least 2 years’ general audit experience
Session Duration
On Site: 2 days
CPE Credits: 16
Session Schedule
This course is offered on site only at this time. Please send an email to express interest in attending this course as an Open Enrollment Virtual Classroom session.
(All session times are shown in Eastern Time)

Questions? Contact us
Phone: +1 (781) 784-4390 Fax: +1 (781) 705-2327 Email: fill out form below
Subject: —Please choose an option— Registration General Information On-Site Information Consulting Information Billing Suggestion Other
[recaptcha size:compact class:captcha]
- How We Train
- Training Catalog
IT Audit Training Courses | Internal Audit Training | Information Security Training | Internal Control Training
Copyright 2023 CPE Interactive, Inc.

- About Auditing
- Related Topics
ISO 14000 Related Topics
- Environmental Management Systems (EMS)
- Plan-Do-Check-Act Cycle (PDCA)
- Quality Management System (QMS)
- Social Responsibility (SR)
- Statistical Sampling
Standards 101 / Standards 101
- What is ISO?
- What are the IEC and USNC/IEC?
- What is a Standard?
- ISO Standards Development Process
- More Standards 101
Auditing Resources
- Case Studies
- Certification
- Our Standards
- Z1.4 & Z1.9
Auditing Related Topics
- Continuous Improvement
- Total Quality Management (TQM)
- Quality Resources /
What Is Auditing?
Quality Glossary Definition: Audit
Auditing is defined as the on-site verification activity, such as inspection or examination, of a process or quality system , to ensure compliance to requirements. An audit can apply to an entire organization or might be specific to a function, process, or production step. Some audits have special administrative purposes, such as auditing documents, risk, or performance, or following up on completed corrective actions.
- The three different types of auditing
- What are first-party, second-party, and third-party audits?
- What are the four phases of an audit cycle?
- Auditing resources
- Become a certified auditor
Learn More About Auditing and ASQ Auditing Certifications
- Process, Product, and System Audits
- First-, Second-, and Third-Party Audits
- What Is the Purpose of an Audit?
- What Are the Four Phases of an Audit?
- ASQ Audit Certifications
The Three Different Types of Audits
ISO 19011:2018 defines an audit as a "systematic, independent and documented process for obtaining audit evidence [records, statements of fact or other information which are relevant and verifiable] and evaluating it objectively to determine the extent to which the audit criteria [a set of policies, procedures or requirements] are fulfilled." There are three main types of audits:
- Check conformance to defined requirements such as time, accuracy, temperature, pressure, composition, responsiveness, amperage, and component mixture.
- Examine the resources (equipment, materials, people) applied to transform the inputs into outputs, the environment, the methods (procedures, instructions) followed, and the measures collected to determine process performance.
- Check the adequacy and effectiveness of the process controls established by procedures, work instructions, flowcharts , and training and process specifications.
- Product audit: This type of audit is an examination of a particular product or service, such as hardware, processed material, or software, to evaluate whether it conforms to requirements (i.e., specifications, performance standards, and customer requirements).
- A quality management system audit evaluates an existing quality management program to determine its conformance to company policies, contract commitments, and regulatory requirements.
- Similarly, an environmental system audit examines an environmental management system , a food safety system audit examines a food safety management system, and safety system audits examine the safety management system.
Audit Considerations
Other methods, such as a desk or document review audit, may be employed independently or in support of the three general types of audits.
Some audits are named according to their purpose or scope. The scope of a department or function audit is a particular department or function. The purpose of a management audit relates to management interests, such as assessment of area performance or efficiency.
An audit may also be classified as internal or external, depending on the interrelationships among participants. Internal audits are performed by employees of your organization. External audits are performed by an outside agent. Internal audits are often referred to as first-party audits, while external audits can be either second-party or third-party.
Auditing on ASQ TV
Purchase ASQ/ANSI/ISO 19011:2018: Guidelines For Auditing Management Systems
What are First-Party, Second-Party, and Third-Party Audits?
- A first-party audit is performed within an organization to measure its strengths and weaknesses against its own procedures or methods and/or against external standards adopted by (voluntary) or imposed on (mandatory) the organization. A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited.
- A second-party audit is an external audit performed on a supplier by a customer or by a contracted organization on behalf of a customer. A contract is in place, and the goods or services are being, or will be, delivered. Second-party audits are subject to the rules of contract law, as they are providing contractual direction from the customer to the supplier. Second-party audits tend to be more formal than first-party audits because audit results could influence the customer’s purchasing decisions.
- A third-party audit is performed by an audit organization independent of the customer-supplier relationship and is free of any conflict of interest. Independence of the audit organization is a key component of a third-party audit. Third-party audits may result in certification, registration, recognition, an award, license approval, a citation, a fine, or a penalty issued by the third-party organization or an interested party.
Industry Certification Through Auditing
Companies in certain high-risk categories—such as toys, pressure vessels, elevators, gas appliances, and electrical and medical devices—wanting to do business in Europe must comply with Conformité Europeënne Mark (CE Mark) requirements. One way for organizations to comply is to have their management system certified by a third-party audit organization to management system requirement criteria (such as ISO 9001 ).
Customers may suggest or require that their suppliers conform to ISO 9001, ISO 14001 , or safety criteria , and federal regulations and requirements may also apply. A third-party audit normally results in the issuance of a certificate stating that the auditee organization management system complies with the requirements of a pertinent standard or regulation.
Third-party audits for system certification should be performed by organizations that have been evaluated and accredited by an established accreditation board, such as the ANSI-ASQ National Accreditation Board (ANAB) .
Performance Audits vs. Compliance and Conformance Audits
Value-added assessments, management audits, added value auditing, and continual improvement assessment are terms used to describe an audit purpose beyond compliance and conformance. The purpose of these audits relates to organization performance. Audits that determine compliance and conformance are not focused on good or poor performance, yet. Performance is an important concern for most organizations.
A key difference between compliance audits, conformance audits, and improvement audits is the collection of evidence related to organization performance versus evidence to verify conformance or compliance to a standard or procedure. An organization may conform to its procedures for taking orders, but if every order is subsequently changed two or three times, management may have cause for concern and want to rectify the inefficiency.
Follow-Up Audits
A product, process, or system audit may have findings that require correction and corrective action. Since most corrective actions cannot be performed at the time of the audit, the audit program manager may require a follow-up audit to verify that corrections were made and corrective actions were taken. Due to the high cost of a single-purpose follow-up audit, it is normally combined with the next scheduled audit of the area. However, this decision should be based on the importance and risk of the finding.
An organization may also conduct follow-up audits to verify preventive actions were taken as a result of performance issues that may be reported as opportunities for improvement. Other times organizations may forward identified performance issues to management for follow-up.
What are the four Phases of an Audit cycle?
- Audit planning and preparation: Audit preparation consists of planning everything that is done in advance by interested parties, such as the auditor, the lead auditor, the client, and the audit program manager, to ensure that the audit complies with the client’s objective. This stage of an audit begins with the decision to conduct the audit and ends when the audit itself begins.
- Audit execution: The execution phase of an audit is often called the fieldwork . It is the data-gathering portion of the audit and covers the time period from arrival at the audit location up to the exit meeting. It consists of multiple activities including on-site audit management, meeting with the auditee, understanding the process and system controls and verifying that these controls work, communicating among team members, and communicating with the auditee.
- Audit reporting: The purpose of the audit report is to communicate the results of the investigation. The report should provide correct and clear data that will be effective as a management aid in addressing important organizational issues. The audit process may end when the report is issued by the lead auditor or after follow-up actions are completed.
- Audit follow-up and closure: According to ISO 19011, clause 6.6, "The audit is completed when all the planned audit activities have been carried out, or otherwise agreed with the audit client." Clause 6.7 of ISO 19011 continues by stating that verification of follow-up actions may be part of a subsequent audit.
Note: Requests for correcting nonconformities or findings within audits are very common.
- Corrective action is action taken to eliminate the causes of an existing nonconformity, defect, or other undesirable situation in order to prevent recurrence (reactive). Corrective action is about eliminating the causes of problems and not just following a series of problem-solving steps.
- Preventive action is action taken to eliminate the causes of a potential nonconformity, defect, or other undesirable situation in order to prevent occurrence (proactive).
You can also search articles , case studies , and publications for auditing resources.
The ASQ Certified Quality Auditor Handbook
Internal Quality Auditing
Advanced Quality Auditing
Auditing: It's All in the Approach ( Quality Progress ) To effectively use the process approach, organizations and auditors alike must understand the difference between a department and the QMS processes employed in that department, and auditors must be competent in the processes they’re auditing.
Starfish and Turtles ( Quality Progress ) Regardless of industry, a typical quality program consists of multiple elements, including internal audits. The process grid walk model is an internal audit initiative that features a self-sustainable self-check method with verifiable deliverables at minimum operating cost.
Auditing Strategy For ISO 9001:2015 ( Journal for Quality and Participation ) Auditing an organization for compliance with ISO standards has two parts: conformance audits and performance audits.
Relating Evidence To Conclusions (PDF) Standards experts and members of U.S. TAG 176 explain that if the intent of an audit is to assess the effectiveness of processes in relation to requirements, auditors must be open to audit a process in relation to the inputs, outputs, and other contributing factors, such as objectives or the infrastructure involved.
ISO 9000 and Audits
The Changing Role of Remote Audits
Become a Certified Auditor with ASQ
ASQ certification is a formal recognition that you have demonstrated a proficiency within, and comprehension of, a specific body of knowledge. In 2016, ASQ Certification exams changed from paper and pencil to computer-based testing via computer at one of the 8,000 Prometric testing facilities, which allows for additional annual exam administrations, greater availability of exam days, faster retesting, and faster test results. Learn more about computer-based testing .
See the Difference Certification Makes
Obtaining your auditing certification is proven to increase your earning potential.
Results from the 2019 Quality Progress Salary Survey showed that U.S. respondents who completed any level of auditor training earned salaries on average of:
- Quality Improvement Associates (CQIA) – $82,892
- Quality Engineers (CQE) – $101,482
- Quality Process Analysts (CQPA) – $XX,XXX
- Pharmaceutical GMP Professionals (CPGP) – $105,346
- Manager of quality/organizational excellence – $108,511
- HACCP Auditors (CHA) – $99,150
- Quality Auditors (CQA) earned almost $10,000 more
See the full results of ASQ’s annual Salary Survey .
Adapted from The ASQ Auditing Handbook , ASQ Quality Press.
Featured Advertisers

Audit Program: Meaning, Objectives, Contents, Advantages, Disadvantages

Meaning of Audit Program
Objectives of the audit program, contents of audit program, advantages of audit program, disadvantages of audit program.
An audit program is a set of policies and procedures to perform and verify the auditing work to evaluate a business’s financial statements.
Professor Meigs defines, “An audit program is a detailed plan of the auditing work to be performed, specifying the procedures to be followed in the verification of each item in the financial statements and giving the estimated time required.”
An audit program is a set of policies and procedures that dictate how an evaluation of a business is done.
This generally involves specific instructions on how much the evidence must be collected and evaluated, who will collect and analyze the data and when this should be done.
These programs check up on a business’s performance, finances, economy, and efficiency and are generally tailored to a specific business or purpose.
It is a description, memorandum, or outline of the work to be done, prepared by an auditor for the guidance and control of the assistants. It guides arranging and distributing the work and checking against possible omissions.
The objectives of the audit program are to:
- Determine compliance with company policy and procedures.
- Determine the effectiveness of the policy and procedures.
- Determine the accuracy of reports generated by department personnel.
- Evaluate the adequacy of internal controls.
- Determine compliance with applicable state and federal regulations of the function under review.
- Search for value-added recommendations that improve the efficiency and contribution of the function under review.
The contents of the audit program are as follows:
- A review of the system of internal check.
- Audit of balance sheet .
- Audit of an income statement .
- The details of various audit work to be performed and their classification.
- Preparation of audit report and coordination of all the above-mentioned items.
The advantages of the audit program are:
- It provides a clear set of instructions on the work to be done.
- It provides a clear record of work done and by whom.
- The senior auditors can review work.
- Work will not be duplicated.
- No important work will be overlooked.
- Evidence of work done is available for use in defending charges of negligence.
- The audit program serves as a shield against any charge of negligence by a client on the part of the auditor.
- It assures that no material aspect of the audit examination has been overlooked.
- It pinpoints the audit work to be done by audit staff, and that has already been done.
- It facilitates the distribution of work among the audit staff according to their knowledge.
- The audit program of last year serves as a basis for preparing the audit program for the subsequent year.
- Before signing the audit report, the final review of the work done can be easily made.
- It ensures adherence to International Accounting and Auditing Standards.
- The responsibility of each audit staff (articled clerk) is fixed.
The disadvantages of the audit program are as follows:
- Work may become mechanical.
- Parts may be executed without regard to the whole scheme.
- A program may be rigidly followed.
- An initiative may be lost.
- Audit staff may not have the opportunity of showing independent thinking, intelligence, and initiative due to adherence to audit programs.
- An audit program may not cover everything that might come up during an audit,
- It may create rigidity in audit examination if not frequently reviewed and updated.
- The audit staff is bound to follow the audit program mechanically irrespective of changes in internal control introduced by the client.
- Audit staff may claim that an audit program did not provide a particular audit examination.
- A fixed auditing program will have its limitations.
- Clients’ staff knowing the extent and methods of checking followed by the auditor, may devise means to escape fraud detection by an auditor.
- Drawing up an audit program may be unnecessary for a small concern.
These disadvantages can be overcome by impressing upon the audit clerk that the audit program is only a guide and he should use his initiative and intelligence during an audit.
He should be encouraged to – make suggestions.
Moreover, the audit programs should be modified from time to time and made up-to-date according to experience and changes made in the business.
ESG | The Report
What is an Audit Work Plan?
Audits are an important tool in risk management. They can be used to monitor a company’s financial performance and compliance with laws, regulations, and contractual agreements. Auditing is primarily conducted by organizations to provide assurance about their systems of internal control over financial reporting, which facilitates the preparation of external reports such as for income tax purposes, shareholders and shareholders. Audit work plans are created for audits that have not yet begun so they can be managed in a timely manner at the beginning stages. In this post we will walk you through the what, the why, the when and the who of an audit work plan.
How do you prepare an audit plan?
What are the 7 steps in the audit process, what is the purpose of the audit work plan, when will an audit work plan be created, who should prepare the audit procedures, what are the benefits of an audit work plan, what are the 5 stages of an audit, what is included in an audit program.
The audit plan should include things like internal auditors’ names, roles and responsibilities; what data will be reviewed; how long it will take; who needs access to information during the process; how much it will cost; assessing risks for mitigation before starting the audit. A good plan is one that enables the internal auditor to be efficient with resources, practical in their scope, and focused on what is important. Working with an experienced MSA team can help with all these steps.
The most successful audits are built upon a solid foundation of planning . The general strategy of an audit work plan is the first step towards an effective process which will deliver value for money and benefits, and which enables an organization to meet its objectives.
The first step in preparing an audit work plan is to obtain an understanding of the proposed project. This includes, but is not limited to:
- The purpose and objective of the audit; In this step, the client needs to provide information about what they are trying to achieve, why, where and when. This will help the auditor understand the background of the audit.
- The business environment surrounding the project; The auditor needs to have a basic knowledge of the industry type, company size, company’s financial statements, operations and their clients’ competition so that they can properly assess risks.
- Scope of the project; This step gives the auditor insight into what parts of the audit will be included, and why. For example, it may be appropriate to exclude social media accounts if they are not related to internal financial reporting. The auditor will also determine whether any modifications need to be made to ISA/PCAOB standards or regulatory requirements based on the client needs.
- The timeframe in which to complete the project; This is important because it determines the resources required (i.e.: human, technological and financial), as well as how to prepare the team for the audit by establishing timelines for training, reviewing documentation, etc.
- A high-level budget; This includes both direct and indirect costs that will be incurred throughout the process by all parties involved (auditors, managers, supervisors, etc.)
- An exhaustive list of all resources that are necessary to perform the audit;
- A thorough review of existing plans, policies or procedures that are related or applicable to the subject matter being audited. These are required because they establish a foundation of knowledge and understanding of the business function and industry which will be fundamental in carrying out the project.
- The time commitment required from employees; This is also necessary information for managers to communicate with their staff members about how long they must dedicate to the project.
- Roles and responsibilities; it is important to determine who, on both sides of the relationship, is responsible for producing required documentation and information. It is also important to clearly define what each party needs to do in order to provide an efficient audit process.
- Who the plan is shared with; it’s necessary that all parties involved are aware of which documents or information they can access throughout the project lifecycle. For example, there may be legal or privacy restrictions that prevent access to certain information.
Establishing a firm foundation for the audit is critical to its success. With a plan in place, everyone involved can work together as a team and know what they need to do next.
This information is then used to construct a formal document that outlines the procedures that will be followed during the course of the audit. This document is should also include, at least:
- A list of all tasks required to complete the project;
- The timeframe for each task;
- The staff responsible for completing each task;
- How any problems or issues that arise will be handled.
Every audit work plan should also include contingency plans in the event that something needs to be addressed outside of the original scope of the audit. For example, if it is determined that additional time is required to complete a certain task, it would be appropriate to create a contingency plan that outlines procedures for how additional time will be allotted.
In essence, an audit work plan should describe the exact course of action that will take place during the course of conducting an audit. The best way to approach any project is with a clear end in sight and this is no exception.
The best way to approach any project is with a clear end in sight and this is no exception.
The 7 steps in the audit process are as follows:
1. Audit Planning
2. Fieldwork / Data Collection
3. Analysis and testing of evidence
4. Drafting the Audit Report
5. Supplementation and Clearance Procedures
6. Completion of Findings and Submission of the Audit Final Report to client
7. Closing letter
With the successful completion of the seven steps, an auditor will be able to turn in a completed audit.

The Auditors are required to submit their plan on how they wish to carry out their auditing procedures. The work plan should include possible alternatives that Auditors had considered for review and also help provide Auditors with a roadmap to follow in the completion of their tasks, all while keeping within the project’s scope.
Preparation of work plans generally begin at least 6 months prior to the initiation of fieldwork for audits that are particularly resource intensive or complex in nature . However, most audit firms will initiate a work plan at the beginning of a new audit assignment. Often this happens on an annual basis.
The person who is assigned with the responsibility for managing the completion of the audit should have the authority to approve the Audit Work Plan as well as any changes that are made to it throughout its duration. In addition, this person is responsible for giving it appropriate attention and supplying any information requested by the Auditor(s) in order to allow them to complete their work.
…organizations expect a detailed approach with the auditor able to provide reasons for the changes…
The main benefit is that it helps ensure that the final product is delivered on time and within budget, which ultimately results in a more efficient process overall.
Also most organizations expect a detailed approach with the auditor able to provide reasons for the changes (i.e., variances) that are noted in their observations and calculations, whether it is positive or negative. This would require an Audit Plan that details all steps of the audit process; otherwise, it becomes difficult to justify any variances/changes noted at any step in the process.
Audit work plan stages include: planning, executing, observing, reporting, and closing.
- Planning is the highest-level step in an audit. This stage consists of defining the scope of your review, what you are looking for in the records you’re auditing. The end result of this phase is developing a list of questions you want answered.
- Executing is the second highest level in an audit. In this stage, you’re going to examine supporting documents and interview staff at your client’s location as well as any people involved with the records that you are auditing.
- Observing includes observing how transactions are processed internally at your client’s location from start to finish and observing the physical environment.
- Reporting is where you explain your observations and document any potential problems or issues that you encountered.
- Closing – The final step in an audit is closing work done on this project and making sure everything has been completed properly. This also involves filing the appropriate documentation for this audit as well as recording what’s been done and why. It is important to let the team know that this project has been completed, so they can begin work on their next stage of an audit.
The last word on an internal audit function and risk assessment
In conclusion, an audit work plan is a must when completing an audit to ensure that everything has been completed with effectiveness in mind. It is to provide a step-by-step method for auditors to follow in completing their tasks which helps avoid any risks, confusion or inaccuracies. Without a plan, it would be difficult to know what the next step is in the procedures and when certain tasks must be completed. By clearly outlining each step of an audit, as well as including necessary deadlines for each task, auditors can enjoy a smoother process overall. Equally, it clearly defines the people and resource needs, which can help minimize cost and time commitment. It also lets you use terms like sufficient appropriate evidence and continual and iterative process. 😉

Research & Curation
Dean Emerick is a curator on sustainability issues with ESG The Report, an online resource for SME’s and Investment professionals focusing on ESG principles. Their primary goal is to help middle market companies automate Impact Reporting with ESG Software. Leveraging the power of AI, machine learning and AWS to transition to a sustainable business model. Serving clients in the United States, Canada, Uk, Europe and the global community. If you want to get started, don’t forget to Get the Checklist! ✅
Privacy Overview
You must be logged in to post a comment.
AccountingTools
Accounting CPE Courses & Books
Audit program definition
What is an audit program.
An audit program is a checklist of the audit procedures that must be followed by an auditor in order to complete an audit . An auditor signs off on each checklist item as it is completed, and then inserts the audit program into the audit working papers as evidence that audit steps were completed. The contents of an audit program will vary by the scope and nature of the audit, as well as by industry. There are a number of standard audit guides available that are tailored to individual industries. Audit programs are used by both internal auditors and external auditors .
Related Courses
Guide to Audit Working Papers
How to Conduct an Audit Engagement
Internal Auditing Guidebook
College Textbooks
Accounting Books
Finance Books
Operations Books
CPA Exam Study Guides
Copyright 2023
Search jobs
Keyword Search
City, State, or ZIP Use my location
Discover a workday that works best for you.
Be a part of the new equation..

While You Work - CPA Acceleration Program Audit Fellow - Summer 2023
To really stand out and make us fit for the future in a constantly changing world, each and every one of us at PwC needs to be a purpose-led and values-driven leader at every level. To help us achieve this we have the PwC Professional; our global leadership development framework. It gives us a single set of expectations across our lines, geographies and career paths, and provides transparency on the skills we need as individuals to be successful and progress in our careers, now and in the future.
As a Specialist, you'll work as part of a team of problem solvers, helping to solve complex business issues from strategy to execution. PwC Professional skills and responsibilities for this management level include but are not limited to:
- Conduct self in a professional manner and take responsibility for work and commitments.
- Flex approach to meet the changing needs of teams and clients.
- Identify and make suggestions for efficiencies and improvements when performing work.
- Take action to stay current with new and evolving technology.
- Use tools, techniques and firm standard methodologies to support research, analysis and problem solving.
- Handle, manipulate and analyse data and information responsibly.
- Communicate with empathy and adapt communication style to meet the needs of the situation and audience.
- Manage expectations of stakeholders effectively.
- Embrace different points of view and welcome opposing and conflicting ideas.
- Uphold the firm's code of ethics and business conduct.
Job Requirements and Preferences : Basic Qualifications : Minimum Degree Required : Bachelor Degree Required Fields of Study : Accounting, Taxation, Finance, Business Administration/Management, Management Information Systems Additional Educational Requirements :
To be eligible for While You Work, applicants must self-identify as Black or African-American or Hispanic or Latinx, which are traditionally underrepresented racial and ethnic minority groups within the professional services industry.
For more information about these requirements, please refer to PwC’s While You Work website at the following URL: pwc.to/whileyouwork
Minimum Years of Experience : 0 year(s) Certification(s) Required :
Before beginning fellowship with PwC, will have completed 120 educational credits toward being eligible for the 150 credit requirement to sit for the CPA exam in certain states.
Preferred Qualifications : Additional Educational Preferences :
Preferred cumulative GPA: 3.3
Preferred major GPA: 3.3
Client service fellowship positions are entry-level roles and job seekers typically need an additional 30 educational credits to complete the necessary 150 credit requirement to become a CPA.
Preferred Knowledge/Skills :
Demonstrates some abilities and/or a proven record of success in the following areas:
- All aspects of the assurance or tax profession and a desire to pursue a career in public accounting and taxation;
- Leveraging knowledge of financial accounting, managerial accounting, taxation, and financial reporting systems including generally accepted accounting principles, current accounting policies and procedures, and having general knowledge of federal and state tax laws in business situations;
- Applying business analytics to uncover errors, inconsistencies or opportunities for improvement in a variety of situations;
- Researching and analyzing technical literature, such as tax laws, rules regulations, accounting principles and policies pertinent in client, industry and technical matters;
- Using problem solving skills on business problems with creativity and an innovative mindset;
- Prioritizing tasks and projects, managing multiple tasks with agility;
- Interacting with various levels of client and firm management through both written and verbal communications;
- Taking responsibility for personal growth and development and is self motivated;
- Working in a team environment, and also function independently;
- Proactively seeking instruction, feedback and coaching to improve performance;
- Responding to client and/or team requests promptly and professionally;
- Readily offering assistance;
- Contributing to a positive, collaborative working environment;
- Prioritizing projects and manage multiple tasks with agility;
- Presenting information, both verbal and written, in a clear, concise manner;
- Innovating using new and existing technologies, along with experimenting with digitization solutions;
- Working with large, complex data sets to build models and leverage data visualization tools; and,
- Demonstrating some technical skills in MS Office (Word, Excel, Access, PowerPoint) and Google G-Suite products.
PwC’s While You Work CPA Acceleration program is a paid part time fellowship through a collaboration between PwC and Northeastern University. The fellowship combines real work experiences at the firm, as a specialist in Tax or Audit, and a tuition paid, online master’s degree program at the D’Amore-McKim School of Business.
Fellows complete Northeastern University’s academic requirements while working a part-time paid schedule at PwC to gain valuable work experience.
- At completion of the program, fellows will have earned a Master of Science from Northeastern University.
- Participants will have earned credit hours to meet the 150 credit hour CPA licensure requirement.
- If accepted, you’ll join PwC as a paid part-time fellow/specialist in audit or tax, a unique role between the traditional intern and associate levels.
- During your fellowship year, you’ll develop your accounting or taxation knowledge and grow your technical and leadership skills that are key to success in today’s workplace
- Fellows will be paid a salary and be eligible for overtime pay, based on work performed for PwC. Fellows are not compensated for the time they dedicate to Northeastern University’s academic requirements.
- Fellows may be offered a full-time associate position at PwC after the successful completion of the fellowship program.

PwC Recruiting: H-1B Lottery Policy
PwC currently is not hiring experienced or entry level job seekers who will need, now or in the future, PwC sponsorship through the H-1B lottery, except as set forth here.

Learn more about what we do
As you prepare to submit your application, take time to review our different career areas and practice teams.

Entry level recruiting process and FAQs
Learn more about our recruiting process, application deadline and assessment.

Top reasons to work at PwC
Explore the top reasons to work at PwC.
Receive email alerts when jobs become available and match your specified area(s) of interest.

Explore benefits
At PwC we offer a comprehensive, flexible and competitive benefits program.
Learn more about our employee benefits

Building on a culture of belonging
At PwC, we are committed to equality and we focus on creating a culture of belonging. We care for our people and are committed to inclusion, understanding and respect for all.
Learn more about our commitment to equality and diversity

No Saved Jobs
Please browse jobs and click the 'save' button on any job that you find.
Then you'll be able to see your saved jobs here.
No Recently Viewed Jobs
Please browse jobs .
Then you'll be able to see your recently viewed jobs here.
Connect with us
Complete the form below to receive alerts when jobs become available that match your customized job area(s) of interest.
Email Address
Job Category Select a Job Category Acceleration Centre Actuarial Services Administration and Secretarial Services Application and Emerging Technology Assurance Support Core Risk Corporate Tax Cybersecurity, Privacy and Forensics Data and Analytics Deals Corporate Finance Deals Transaction Services Delivering Deal Value Enabling Technologies Consulting External Audit Finance Finance Consulting Financial Markets Business Advisory Financial Risk and Regulatory Financial Services Solutions Firm Strategy and Communications Functional and Industry Technologies General Consulting Human Resources Information Security Information Technology Information Technology Risk Assurance Innovation International Tax Services Interns and Trainees Managed Services Microsoft Dynamics National Special Functions Office of General Counsel Operations Consulting Oracle Consulting People and Organisation Platform Architecture Process Assurance Product Innovation Products and Technology PwC Private Risk Assurance Compliance and Analytics Risk Management Risk Management - One Firm Risk Organization Risk Modeling Services Sales and Marketing Salesforce Consulting SAP Consulting State and Local Tax Tax Services Transfer Pricing United States National Tax Practice Workday Consulting
Location Select Location Alabama, United States Arizona, United States Arkansas, United States California, United States Colorado, United States Connecticut, United States DC, United States Florida, United States Georgia, United States Illinois, United States Indiana, United States Iowa, United States Kentucky, United States Louisiana, United States Maryland, United States Massachusetts, United States Michigan, United States Minnesota, United States Missouri, United States Nebraska, United States Nevada, United States New Jersey, United States New York, United States North Carolina, United States Ohio, United States Oklahoma, United States Oregon, United States Pennsylvania, United States San Juan, Puerto Rico South Carolina, United States Tennessee, United States Texas, United States Utah, United States Vermont, United States Virginia, United States Washington, United States Wisconsin, United States
Level Select Job Level Manager Senior Associate Senior Manager Director Intern Administrative Associate Specialist
- External Audit, San Francisco, California, United States Remove
- External Audit, Hartford, Connecticut, United States Remove
- External Audit, Tampa, Florida, United States Remove
- External Audit, Atlanta, Georgia, United States Remove
- External Audit, Boston, Massachusetts, United States Remove
- External Audit, Greensboro, North Carolina, United States Remove
- External Audit, Raleigh, North Carolina, United States Remove
- External Audit, New York, New York, United States Remove
- External Audit, Philadelphia, Pennsylvania, United States Remove
- External Audit, Salt Lake City, Utah, United States Remove
- External Audit, Milwaukee, Wisconsin, United States Remove
Confirm Email
Your consent for job alert email communications is ongoing. You can revoke your consent at any time by clicking the unsubscribe button at the bottom of the job alert email and following the prompts. By submitting your information, you acknowledge that you have read and understood our Privacy Statement .
PricewaterhouseCoopers LLP 300 Madison Avenue, New York, New York 10017-6204
- Skip to primary navigation
- Skip to main content
- Skip to primary sidebar
- Skip to footer

Audit Plan Meaning
An audit plan refers to the design of an audit describing the overall audit strategy and guidelines to follow while performing the audit. It helps in the successful completion of the audit process.
Planning for auditing is the initial step in an audit. It helps the auditor efficiently manage the audit by analyzing the prime focus areas, proactive problem management, and allocating responsibilities to team members.
Table of contents
Audit plan process.
- Sample Audit Plan
- Audit Plan Example
Frequently Asked Questions (FAQs)
Recommended articles, key takeaways.
- An audit plan represents a blueprint for conducting an audit. It addresses why, when, how, where, and by whom questions associated with audit performance.
- A good audit design identifies all the risks involved in the operations and employs specific audit procedures to minimize them.
- Successful planning for audit necessitates the cooperation of the management. Auditor has the authority to question the concerned personnel in case of any discrepancies.
- Auditors follow more or less the same procedure for auditing most of the companies by adhering to the standard auditing procedures.
According to the international standard of auditing (ISA), an audit plan should be based on an overall audit strategy. The audit strategy must explain the scope, timing, and direction of the audit. In addition, strategy formulation depends on the features of audit engagement like its characteristics, reporting objectives, auditor’s professional judgment, the outcome of preliminary engagement activities, and the resources necessary to perform the audit engagement.
According to ISA, in addition to client information, audit planning steps should contain the description for nature, timing, and extent of:
- Planned risk assessment procedures
- Programmed further audit procedures at the assertion level
- Other programmed audit procedures that are required to accomplish so that the engagement complies with professional standards

You are free to use this image on your website, templates, etc., Please provide us with an attribution link How to Provide Attribution? Article Link to be Hyperlinked For eg: Source: Audit Plan (wallstreetmojo.com)
The auditor Auditor An auditor is a professional appointed by an enterprise for an independent analysis of their accounting records and financial statements. An auditor issues a report about the accuracy and reliability of financial statements based on the country's local operating laws. read more can update the audit design according to the development during the audit. Moreover, the auditor also includes supervising and reviewing team members’ work in the plan. The resulting documentation primarily contains the overall strategy and plan. In addition, it may consist of the changes applied to the overall strategy and audit plan processes during its implementation and the reason for changes.
Sample Audit Plan
Let’s look at the sample below to understand better the structure, layout, contents, and overall audit plan template.

To comprehend each business element relevant to the audit, the auditors collect and evaluate information about the company, such as financial, legal, and investment facts. In addition, they utilize risk assessment techniques to analyze the risks of anomalies in business governance, notably financial statement misstatements.
The audit team utilizes audit techniques to collect audit evidence Audit Evidence Audit evidence is information gathered by auditors during the course of an audit, whether internal, statutory, or otherwise. These facts serve as the foundation for the opinion in the audit report. read more once the risks have been recognized. This audit evidence assists them in forming a judgment on the company’s financial statements Company's Financial Statements Financial statements are written reports prepared by a company's management to present the company's financial affairs over a given period (quarter, six monthly or yearly). These statements, which include the Balance Sheet, Income Statement, Cash Flows, and Shareholders Equity Statement, must be prepared in accordance with prescribed and standardized accounting standards to ensure uniformity in reporting at all levels. read more . Audit techniques often employed by auditors include analytical procedures, investigation, examination of records and assets, observation, reconciliation Reconciliation Reconciliation is the process of comparing account balances to identify any financial inconsistencies, discrepancies, omissions, or even fraud. At the end of any accounting period, reconciliation involves matching balances and ensuring that debits (credits) from one account for one transaction is same as the credit (debits) to another account for the same transaction. read more , and reperformance. The auditor’s assessment of the risks influences the audit method’s nature, timing, and scope.
Furthermore, the knowledge and experience of the auditors will undoubtedly reflect in the conversations throughout the work plan development. This knowledge transfer method guides audit engagement teams throughout different processes such as information evaluation and risk identification.
Audit Plan Example
Having a punctiliously crafted audit design helps auditors achieve efficient engagement, risk mitigation, and compliance with standards set by authorized governing bodies. In addition, the company being audited should be ready and offer coordination to assist in the efficient completion of the audit. Let us look into the significance of a well-informed design with the help of an audit plan example.
During one of their client’s previous year audits, the auditor of a CPA firm reported the deficiency in internal control Internal Control Internal control in accounting refers to the process by which a company implements various rules, policies, or procedures to ensure the accuracy of accounting and finance information, safeguard the various assets of the business, promote accountability in the business, and prevent the occurrence of frauds in the company. read more when he found out the existence of fictitious vendor Vendor A vendor refers to an individual or an entity that sells products and services to businesses or consumers. It receives payments in exchange for making items available to end-users. They constitute an integral part of the supply chain management for providing raw materials to manufacturers and finished goods to customers. read more invoices related to inventory. The auditor painstakingly considers the issue in the current year by addressing it in the risk assessment or designed audit procedures Audit Procedures Audit Procedures are steps performed by auditors to get evidence regarding the quality of the financial information provided by the management of a company. It enables them to form an opinion on financial statements and ensure whether they reflect the true and fair view or not. read more to ensure that the management rectified the problem. The auditor plans to assess the risk of inventory fraud with the help of observation of physical inventory and analytical procedures and describes its nature, time, and extent. Hence, what is more important is the treatment of planning as a continuous process commencing from the end of the previous year audit and comes to an end with current audit engagement completion.
The vital thing is to develop an overall audit strategy. The plan should be in line with the audit strategy so that the plan entails the successful completion of the audit objectives. Generally, the audit design must encompass the nature, timing, and extent of risk assessment procedures, further audit procedures at the assertion level, and other planned audit procedures to complete the process while ensuring professional standards.
The two elements of planning are creating an overall audit strategy and the associated plan. Following different activities like collecting client requirements and information and verifying the applicable laws is vital in preparing an audit strategy. It should align with audit objectives and contribute to the act of curating an audit work plan.
An audit design contains a list of guidelines for auditors to follow while conducting an audit. In contrast, an audit program is the description of detailed steps to complete the audit procedure. Both deeds give direction to auditors and other team members while auditing.
This has been a guide to Audit Plan and its Meaning. Here we discuss its process and sample along with their examples. You may also have a look at the following articles to learn more –
- Interim Audit
- Purpose of An Audit
- Privacy Policy
- Terms of Service
- Cookie Policy
- Advertise with us
- Investment Banking Resources
- Financial Modeling Guides
- Excel Resources
- Accounting Resources
- Financial Statement Analysis

- The Hartford Insurance
- Business Insurance
- Workers’ Compensation Insurance
Workers’ Comp Audit
Get Great Coverage in Minutes All it takes is a few clicks.
What Is a Workers’ Compensation Audit?

- Medical care
- Wages from lost work time
- Ongoing care
- Funeral costs
- Disability benefits
What Is the Purpose of a Workers’ Comp Audit?
When should i expect a workers’ comp audit, how does the hartford do a workers’ compensation audit, how does the hartford schedule a workers’ comp audit, how are appointments for workers’ comp audits made, types of workers’ compensation audits.
- Field audits are physical audits on-site at your place of business.
- Phone audits are done remotely. There’s no travel needed for these workers’ compensation audits. Once you send us your information, we’ll schedule the phone audit.
Comply With Your Insurer During a Workers’ Comp Audit
- Underreporting payroll to reduce a workers’ comp premium.
- Supplying inaccurate job descriptions to represent lower risk for reduced workers’ compensation premiums.
- Providing false financial documents, such as fake tax returns.
- Not reporting subcontractors to lower your workers’ compensation premium. Make sure you check your state’s laws to see if you need to report independent contractors.
Getting the Results of a Workers’ Comp Audit
Prepare for a workers’ compensation audit.
- Organizing all your documents
- Collecting information you need consistently
- Documenting any changes to job descriptions and other business functions as they happen
Create a Workers’ Comp Audit Checklist

- The state where they work
- Their corporate title
- The percentage of stock they own
- How long they’ve been employed
- Their total earnings
- Certificates of insurance for each leased employee or subcontractor
- Your general ledger
- Sales journal
- Cash receipts
- Sales tax records
Workers’ Comp Audit Checklist
- An accounting ledger
- Tax forms such as W-2, 1099, Form 941, Form 944 and a federal tax returns
- Certificate of insurance for every subcontractor
- Detailed descriptions of each business function

Workers’ Compensation Audit
More answers to frequently asked workers' comp insurance questions.
Compliance Auditing 101: Types, Regulations and Processes
Smartsheet Contributor Andy Marker
January 18, 2018
The rules that society runs on are essentially agreements that we will all perform activities in a prescribed way for the health, safety, and benefit of everyone. In business, rules and conventions may be voluntary to show that products and services adhere to certain standards, or they may be compulsory to comply with federal or local rules and regulations. Adherence to voluntary and compulsory standards are confirmed through compliance audits. These periodic surveys of policies, processes, procedures, files, and documentation in for-profit and nonprofit entities are conducted by hired professionals or government auditors. These surveys verify the effectiveness of internal controls and processes to ensure that standards and regulations are met.
In this article, we’ll discuss some of the many voluntary standards and compulsory regulations that require audits, how compliance audits are conducted, and how auditors are trained and continue to keep their professional edge.
What Is a Compliance Audit?
A compliance audit is an independent evaluation to ensure that an organization is following external laws, rules, and regulations or internal guidelines, such as corporate bylaws, controls, and policies and procedures. Compliance audits may also determine if an organization is conforming to an agreement, such as when an entity accepts government or other funding. Although most people are familiar with financial audits, such as those for public companies through the Sarbanes-Oxley Act (SOX) or individual or corporate tax audits through the Internal Revenue Service (IRS), compliance audits are not merely financial. Audits may also review IT and other security issues , compliance with HR laws, quality management systems, and other areas. Compliance is one leg in the tripod of GRC, which stands for governance, risk, and compliance.
Compliance is important for many reasons. Aside from signifying levels of professional standards, like the ISO 9000, ISO 14000, and other guidelines, noncompliance with regulatory guidelines may bring sanctions and penalties. Penalties for noncompliance with federal regulations, such as Sarbanes-Oxley, are specified through the Federal Sentencing Guidelines Act and apply fines based on a formula that calculates the most recent offenses and determines whether the organization employs a compliance officer who communicates regulatory needs to the organization.
Boards of directors are also often accountable for operations and need to see audit reports. If a regulatory agency does investigate, proof of a compliance program is important to show that the organization has controls and other mechanisms that can detect deficiencies and even illegal activity.
Depending on the circumstances, the audit may be conducted by an employee, such as an internal auditor, a certified public accountant, a third-party auditor, or a government auditor. In many circumstances, auditors may seek the expert advice of outside specialists, such as lawyers.
Audits provide recommendations on ways to make improvements or corrective actions and to prevent future deficiencies or nonconformities. Audits review for effectiveness to determine the number of compliant versus non-compliant processes. Audits also help organizations to stay in compliance with frequently changing federal regulations. In addition, audits identify areas of risk for noncompliance within the organization and report these appraisals to management and the appropriate regulatory entity as applicable.
Essentially, a compliance audit asks if you are doing what you said you would do.
What Is the Purpose of a Compliance Audit?
A compliance audit gauges how well an organization adheres to rules and regulations, standards, and even internal bylaws and codes of conduct. Part of an audit may also review the effectiveness of an organization’s internal controls. Different departments may use multiple types of audits. For example, accounting may use internal, compliance, and operational audits. Audits may be required by different levels of government.
- Internal Audits: Although some conflate the notions of compliance audits and internal audits (often using personnel from an internal audit team), these two types of audits represent separate approaches. Internal audits ensure that an organization follows process, procedures, and guidelines — in other words, its own internal controls. This type of audit also guarantees that these controls prevent and detect errors or illegal acts. A compliance audit, on the other hand, ensures that the organization is fulfilling outside obligations, such as rules and regulations, agreements, or standards. Internal audits may be operational, IT, financial, or regulatory, but are conducted using formal audit methodologies appropriate to the subject area. Internal audits are not available to regulators and tend not to be made public, although sometimes social compliance audit results are released as part of a company’s rebranding. Internal audits may be conducted prior to an outside compliance audit to ensure that the organization is following standards.
- Compliance Audits: Compliance audits differ from internal audits in that they are outward-facing, ensuring that the company complies with regulations or codes of conduct. Ideally however, both internal and compliance audit functions share the same language (and even software) to make sure that reviews are comprehensive.
- Operational Audits: Operational audits determine how efficient and effective different departments and activities are and whether these areas function in alignment with the mission and intent of the organization.
Auditing Is Not Monitoring
An audit is not the same thing as ongoing monitoring. Audits are discrete experiences, akin to projects, and are usually conducted by disinterested outsiders. Monitoring is an ongoing effort to ensure that controls accurately guide processes. Monitoring is also the responsibility of management.
Who Conducts Audits?
Internal audits are usually conducted by employees. Larger organizations may keep an entire department to manage internal audits. However, to maintain objectivity, it is essential that the auditor have no direct connection to the area or department being audited. An internal auditor or audit manager has the specific duty to inform management of changes or deficiencies in controls and to recommend actions to improve controls and processes. Still, internal auditors are not responsible for monitoring internal or external compliance. Some feel that special training is not required for the internal auditing role. Auditors may also hire experts, such as university professors, to review practices.
For compliance audits, large organizations in particular may support an entire compliance department headed by a compliance manager to ensure adherence to codes, standards, and regulations. In fact, as the number of federal regulations has grown beyond the number of government auditors available to monitor compliance, the number of internal compliance officers has also grown. Compliance staff members have knowledge of the pertinent laws, regulations, and internal codes of conduct and bylaws. They may also have sufficient subject-area knowledge, like mechanical or environmental engineering for instance, to conduct operational audits. Individuals with a financial background would focus on accounting matters.
Different Audit Criteria
Within the United States alone, multiple voluntary and compulsory audits exist based on standards and regulations. Financial audits in the U.S. are governed by generally accepted auditing standards ( GAAS ), which provide guidelines for preparing for and conducting audits. Government Auditing Standards apply to the audits of government organizations as well as to the programs and activities of contractors who receive government funds. Such standards may also apply to nonprofit organizations and non-government organizations that receive government funds. Audit evaluation criteria may also change based on whether a company is public or private. Often, federal agencies offer compliance support in the form of hotlines and websites to help organizations navigate regulatory labyrinths.
The following are just a few of the possible audit standards and guidelines in the U.S.:
- Compliance Auditing Considerations in Audits of Government Entities and Recipients of Government Financial Assistance (AU 801): This guideline specifies definitions, management roles, and requirements for compliance audits of financial situations for government entities and organizations that receive government funding. They are published and managed by the Public Company Accounting Oversight Board (PCAOB).
- Sarbanes-Oxley Act (SOX): SOX compliance audits require a specific audit of financial records and financial and operational controls. In addition to payroll and finance departments, IT departments are subject to particular audits to ensure controls for disaster recovery for electronic communications, appropriate change management tools, and complete audit trails.
- Social Compliance: Social compliance and sustainability codes of conduct define employee working rights, health and safety rights, and environmental sustainability standards. Audits verify that suppliers and facilities in a supply chain adhere to the guidelines. Nonconformities may trigger sanctions, including loss of brand business.
- Healthcare Insurance Portability and Accountability Act (HIPAA): HIPAA compliance audits check that organizations follow the standard for protecting personal data in healthcare. Organizations that handle personal healthcare information (PHI) must ensure the physical, electronic, and procedural security of data.
- Payment Card Industry Data Security Standard (PCI DSS): PCI DSS is a set of standards that businesses must implement to be certified to store, process, or transmit electronic payments. If your organization processes more than six million credit card transactions per year, an annual audit is compulsory to ensure that networks, systems, and processes can protect sensitive information and detect breaches in a timely manner.
- Human Resources (HR): Although various types of HR audits exist, a legal compliance audit verifies that an entity follows federal, state, and local employment laws and regulations. Particular areas of concern for companies include the misclassification of non-exempt work and inadequate personnel files.
- Payroll: Payroll compliance audits determine whether an employer is complying with collective bargaining agreements.
- Internal Revenue Service (IRS): The IRS audits individuals, corporations, and nonprofit entities to ensure that income taxes are paid. The IRS refers to their audits as examinations because they follow tax code and not generally accepted accounting principles.
- State and Local Tax (SALT): State and local auditors may review records of business and individuals to verify that state and local taxes, such as income tax and sales tax, are paid.
- Financial Industry Regulatory Authority (FINRA): FINRA is not a government body, but it works together with the Securities and Exchange Commission (SEC). FINRA specifies annual audits for financial, brokerage, securities, and investment firms. This entity checks licensing, advertisements, and day-to-day activities to verify that trading practices are fair. Repercussions for a poor audit result can include fines, suspensions, or disbarment.
- Can-Spam Act: This is a federal law implemented by the Federal Trade Commission (FTC) that governs bulk mail and commercial electronic messages to eliminate offensive, annoying, or misleading commercial email. The law applies to commercial business and also to nonprofit organizations. Commercial email senders may want to audit their system for opt-out efficiency and audit vendors.
- Occupational Health and Safety Act (OSHA): OSHA implements workplace health and safety standards for most workers, including office workers, and extends to those in such fields as manufacturing, construction, private education, and disaster relief. OSHA audits ensure that workplaces are hygienic and hazard-free.
- Environmental Protection Agency (EPA): The EPA works with state, tribal, and other federal authorities to promote adherence to environmental laws. Environmental integrity is ensured by inspections and testing, but also through a robust self-monitoring and self-reporting mechanism.
- Securities and Exchange Commission (SEC): The SEC audits financial institutions, such as securities advisors, to ensure that investors are well-informed about purchases and that clients are fairly treated.
- The Centers for Medicare and Medicaid Services (CMS) (formerly the Health Care Financing Administration): The CMS is an agency within the federal Department of Health and Human Services. It oversees Medicare funding and partners with states to administer Medicaid. Audits of facilities are conducted regularly to ensure funds are used and tracked correctly.
- ISO 14001: Established in 1996 by the International Organization for Standards, the ISO 14000 series and the certifiable standard, 14001, is an internationally designed guidance for businesses to limit environmental impact through reducing waste and using supplies more efficiently. Certification is voluntary, but requires an initial audit and periodic maintenance audits.
- Social Compliance: Social compliance standards center on sustainable labor and environmental practices throughout a company’s supply chain. Standards may be specified in laws and regulations, in company-drafted codes of conduct, or in policies that are agreed upon by various industries. Social compliance audits are often required by brands, but paid for and initiated by suppliers.
- SSAE-16: Statements on Standards Attestation for Engagements governs reports on controls at financial service organizations, such as data centers, ISPs, and other entities that may store, handle, or transmit sensitive data.
ISO 9001: An internationally agreed-upon quality management standard, ISO 9001 certification is voluntary, but requires an initial audit and periodic maintenance audits.
Who Participates in Compliance Audits?
Depending on the type of audit, many departments in one firm may be subject to an audit, from finance to payroll to production to IT to sales. Auditors may interview employees throughout the hierarchy. However, particular emphasis is placed on managers. AU 801, for example, holds management responsible for understanding compliance requirements, ensuring that adequate controls are in place to sustain compliance, regularly checking to certify that compliance is met, and then implementing corrective actions to mitigate deficiencies or nonconformities. With SOX compliance audits, CEOs and CFOs must attest to the integrity of controls and the accuracy of financial reports. PCI compliance audits may interview CIOs, CTOs, and IT admins to determine how users are tracked and to review the audit trail from IT event log and change management software.
The History of Compliance Auditing
Although regulations of standardized weights, measures, and practices can be traced back to craft and merchant guilds of the Middle Ages, regulations and compliance grew mainly with the Industrial Age. Governments, professional groups, and social welfare organizations sought increased oversight and control over business practices. Internal auditing was the first innovation beginning in the 1970s, as companies sought to ensure the integrity of their own practices. In addition to voluntary certification standards, such as the ISO 9000, the previous century saw the rise of government monitoring authorities. For example, besides multiple federal agencies that conduct their own audits, the Office of the Inspector General includes a sub-office in each federal department.
The Challenges of Compliance Auditing
Compliance can seem to present organizations with a predicament in which they are liable for penalties whether they work to comply or not. Deficiencies discovered in a regulatory audit may be subject to fines. However, any deficiencies that are not discovered in an audit may still subject an organization to a third-party lawsuit. Deficiencies disclosed in self-auditing and self-reporting can still garner significant penalties.
How Are Compliance Audits Conducted?
An auditor may work alone or in collaboration with other functions, like human resources, IT, legal and security. An auditor must have access to records. In addition, auditing questionnaires and formal interviews provide a richer picture of the organization’s situation. Depending on the area of audit, statistical or judgemental sampling may be used. Statistical sampling provides an existing model of conformities and outliers. Judgemental testing may not allow for generalization to a wider sample, but the types and numbers of nonconformities and outliers may indicate risk areas.
Whether the audit is internal or for compliance, management must understand that they are ultimately responsible for creating internal controls and ensuring compliance. In general, most sources agree that all levels of management are responsible for creating appropriate policies and procedures and monitoring them to verify adherence.
Here are the steps in a compliance audit:
- The organization contacts the auditor. The auditor and the organization decide if the auditor’s expertise is a good fit.
- The auditing firm sends a proposal either to the company or to the attorney for instances where compliance audits should invoke client-attorney privilege.
- At a preliminary meeting, the auditor describes the guidelines for the audit and what is required. The auditor may provide auditing checklists, so the client can prepare.
- For a small organization, the auditor may work by phone. The organization completes audit questionnaires and supplies the auditor with needed documents. The auditor may work on site to view documents, walk through work spaces, study infrastructure and security features, and interview management and employees.
- The report should be delivered within a relatively short time. In the case of social compliance audits of facilities, the turnaround may be as fast as the next day. At the final meeting, the auditor presents and discusses the report and makes recommendations to address any areas of risk. Whether working under a regulatory deadline or not, organizations should generally remedy any deficiencies within 120 days to ensure that they complete corrective actions and don’t simply shelve them until the next audit. However, auditing firms usually also offer follow-up support to help organizations remedy any risks or deficiencies. Auditors then verify that measures have been met.
The Importance of Compliance Auditing in Healthcare Organizations
Healthcare organizations are required to abide by stringent security measures and remain compliant with the HIPAA guidelines, meaning compliance audits are extremely necessary to ensure that a business is following external rules, regulations, policies, and procedures, while also accurately tracking how confidential information, like protected health information (PHI), is stored and secured.
HIPAA regulations mandate that healthcare organizations implement compliance auditing procedures to establish plans of action for conflict of interest procedures, compensation agreements between related organizations, and federal claim monitoring. Compliance audits establish a clear line of communication between all members of an organization, and ensure visibility into regulatory guidelines and the organization’s adherence to them.
Since healthcare companies must always remain compliant and regularly audit their processes and guideline adherence, they need a tool to help them keep track of all policies and procedures, provide critical information for reviews, and ensure that the integrity of their business is not in jeopardy.
Smartsheet is a work execution platform that enables healthcare companies to improve auditing processes, manage external rules and regulation information, and track and store historical records in one centralized location, while meeting or exceeding all of HIPAA’s regulatory requirements. Streamline reporting, organize all necessary information in one centralized location, and roll up compliance reports for increased visibility.
Interested in learning more about how Smartsheet can help you and maximize your efforts? Discover Smartsheet for Healthcare .
What Is a Compliance Test?
Used in many industries, including software development, a compliance test is a non-functional test that is performed to ensure that something meets the specified standards and requirements for the deliverable.
What Is a Compliance Test in Auditing?
In auditing, a compliance test confirms the presence of controls and their application. Substantive tests verify the integrity of controls and the actual accuracy of documents, such as balanced accounting sheets.
How Do You Become a Compliance Auditor?
Almost every industry may be subject to audit. For that reason, many different types of auditors exist:
- External auditors from accounting firms
- Regulatory auditors with legal backgrounds
- Technical compliance auditors to check safety issues at plants
- Quality assurance auditors with manufacturing and production experience
- State, local, municipal, and regulatory auditors
- Various U.S. government regulatory auditors
Auditors require a sufficiently solid background in audit to review laws, regulations, and guidelines, although they may recruit the help of lawyers or other subject-matter experts, particularly for those instances when regulatory guidelines or policies are not definitive. On the other hand, auditors must have the communication skills to clarify the relevance of law and policy to employees at all levels of the company.
Compliance Auditing Skills and Qualifications
In general, in addition to domain training, auditors must have a minimum of a bachelor's degree. For career advancement, they should have a master’s degree. Public accounting firms, for example, might require knowledge of the Financial Accounting Standards Board and the Statements of Financial Accounting Standards (SFAS) for financial auditing. Auditors in many fields may find it useful to have skills in operations research, statistical analysis, auditing, quality management, and general consulting.
Professional improvement and support come to compliance auditors through assorted organizations, each often geared toward a speciality. Here are the major credentials and professional organizations associated with compliance auditing:
- Society of Corporate Compliance and Ethics (SCCE): This nonprofit organization offers individual memberships to help compliance professionals stay current through training, conferences, and certification. Voluntary certifications include Certified Healthcare Compliance (CHC), Certified Healthcare Privacy Compliance (CHPC), Certified Healthcare Research Compliance (CHRC), Certified Healthcare Compliance Fellow (CHC-F), Certified Compliance and Ethics Professional (CCEP), Certified Compliance and Ethics Professional International (CCEP-I), and Certified Compliance and Ethics Professional Fellow (CCEP-F).
- American Institute of Chartered Public Accountants (AICPA): This organization assists with professional development for general accounting and with guides and checklists for tax compliance auditing.
- Health Care Compliance Association (HCCA): HCCA offers professional development and networking for compliance auditors across a range of regulated health care entities.
- National Society of Compliance Professionals (NSCP): This is a professional association for compliance professionals in the financial industry, including securities. It offers the Certified Securities Compliance Professional (CSCP) certification on successful completion of Utica College’s 12-month online securities compliance course.
How Much Do Compliance Auditors Make?
According to PayScale.com, the median salary for compliance auditors in the U.S. is around $55,000. Entry-level pay can start in the low 30 thousands. Managerial compliance roles in the sciences and medicine can garner more than $100,000 annually.
Auditing Definitions
The following are definitions of some of the basic aspects of compliance auditing. For a detailed list of accounting audit definitions, see PCAOB document AU 801 .
- Applicable Compliance Requirements: These are compliance requirements that are subject to the compliance audit.
- Audit Evidence: Information that the auditor must report as part of a prescribed audit. This includes details collected during an audit that allow an auditor to reasonably form an opinion about the documents, procedures, and processes being audited.
- Audit Risk: This is the risk that an auditor will express an inappropriate audit opinion on the entity's compliance and on the documents under review.
- Control Risk: This refers to the possibility that an organization’s internal controls may not detect or prevent compliance deficiencies.
- Due Professional Care: This concerns an auditor’s effort to collect appropriate audit evidence to show that financial statements do not contain material misstatement.
- Generally Accepted Accounting Principles (GAAP): The accounting guidelines for reporting financial statement transactions that are used most frequently in the United States.
- Generally Accepted Auditing Standards (GAAS): This is a U.S. standard for planning, implementing, and following up on compliance audits.
- Government Auditing Standards: These are guidelines that are specific to the U.S. government for financial audits, attestation engagements, and performance audits. They are also known as the Yellow Book or generally accepted government auditing standards (GAGAS).
- Going Concern: A business is considered a going concern when it can be reasonably expected to continue to operate for a minimum of 12 additional months.
- Grantor: A grantor is the government agency that provides funding for a government program.
- Internal Controls: The operating standards a client uses to prevent or uncover mistakes
- Pass-through Entity: This is an organization that receives funding from a grantor or elsewhere and provides all or part of those funds to another organization to administer a government program.
- Management Assertions: These are statements that an organization’s management makes concerning financial documents.
- Materiality: Materiality is the importance of an aspect of financial reporting in relation to other financial questions.
- Objectivity: This is when one approaches an audit with no preconceptions about the client or their compliance situation.
- Sampling: This refers to a significant subset of a population of data or records that is used to represent the whole.
Improve Compliance Auditing with Smartsheet for Professional Services
Empower your people to go above and beyond with a flexible platform designed to match the needs of your team — and adapt as those needs change.
The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed.
When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time. Try Smartsheet for free, today.
Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.
Discover why over 90% of Fortune 100 companies trust Smartsheet to get work done.

Official websites use .mass.gov
Secure websites use HTTPS certificate
A lock icon ( ) or https:// means you’ve safely connected to the official website. Share sensitive information only on official, secure websites.

- This page, Annual Report Medicaid Audit Unit for March 2, 2022 through March 1, 2023, is offered by
- Office of the State Auditor
Report Annual Report Medicaid Audit Unit for March 2, 2022 through March 1, 2023
A review of the work conducted by the Office of the State Auditor's Medicaid Audit Unit over the past year. It highlights audits released, audits in progress, and the impact of the Unit's work.
Introduction
The Office of the State Auditor (OSA) receives an annual appropriation for the operation of a Medicaid Audit Unit (the Unit) for the purposes of preventing and identifying fraud, waste, and abuse in the MassHealth system and making recommendations for improved operations. The state’s fiscal year 2023 budget (Chapter 126 of the Acts of 2022) requires that OSA submit a report to the House and Senate Committees on Ways and Means by no later than March 1, 2023 that includes (1) “all findings on activities and payments made through the MassHealth system;” (2) “to the extent available, a review of all post-audit efforts undertaken by MassHealth to recoup payments owed to the commonwealth due to identified fraud and abuse;” (3) “the responses of MassHealth to the most recent post-audit review survey, including the status of recoupment efforts;” and (4) “the unit’s recommendations to enhance recoupment efforts.”
For fiscal year 2023, the appropriation for the Unit was $1,358,812. This amount represents an approximately 3.5% increase over the Unit’s fiscal year 2022 appropriation of $1,312,862. OSA submits all costs (direct and indirect) associated with running the Unit to the Executive Office of Health and Human Services (EOHHS) to be included in its quarterly filings with the Centers for Medicare & Medicaid Services for federal cost sharing. In federal fiscal year 2022, OSA submitted a total of $1,393,248 to EOHHS for consideration for the state’s program integrity, allowing the state to obtain a 50%, or $696,624, reimbursement of these costs.
This report, which is being submitted by OSA in accordance with Chapter 126 of the Acts of 2022, provides summaries of the following three performance audits of MassHealth: telehealth services paid for by MassHealth, MassHealth’s Continuity of Operations Plan, and the Delivery System Reform Incentive Payment Program.
It also provides summaries of audits conducted of two MassHealth dental providers. [1]
This report details potential missed cost savings of $91,852,881 in the administration of telehealth services, as well as $4,591,628 in improper payments to dental providers for undocumented services. It also describes corrective actions MassHealth is taking in response to three audits issued at least six months ago for which follow-up surveys have been completed. MassHealth and the two MassHealth providers who were audited reported actions or planned actions on 13 (100%) of our 13 audit recommendations, which will improve operational efficiency and effectiveness.
[1] . These five audits were conducted under the oversight of former State Auditor Suzanne M. Bump. Auditor DiZoglio took office on January 19, 2023.
EOHHS administers the state’s Medicaid program, known as MassHealth. This program provides access to healthcare services annually to approximately 2.3 million eligible low- and moderate-income children, families, seniors, and people with disabilities. In fiscal year 2022, MassHealth paid more than $19.8 billion to healthcare providers, of which approximately 35% was funds paid by the Commonwealth. Expenditures, including administration costs, for the Medicaid program represent approximately 32% of the Commonwealth’s total annual budget.
Heightened concerns over the integrity of Medicaid expenditures were raised in January 2003, when the US Government Accountability Office (GAO) placed the US Medicaid program on its list of government programs that are at “high risk” of fraud, waste, abuse, and mismanagement. At that time, GAO estimated that between 3% and 10% of total healthcare costs were lost to fraudulent or abusive practices by unscrupulous healthcare providers. Based on these concerns, OSA began conducting audits of Medicaid-funded programs and, as part of its fiscal year 2007 budget proposal, submitted a request to establish a Medicaid Audit Unit within its Division of Audit Operations dedicated to detecting fraud, waste, and abuse in the MassHealth program. With the support of the Massachusetts Legislature and the Governor, this proposal was acted upon favorably and has continued to be funded in subsequent budgets. Since that time, OSA has maintained ongoing independent oversight of the MassHealth program and its contracted service providers. Audit reports issued by OSA have identified weaknesses in MassHealth’s controls to prevent and detect fraud, waste, abuse, and mismanagement in the Massachusetts Medicaid program as well as improper claims for Medicaid services.
OSA uses data analytics in all audits conducted by the Unit. By so doing, our auditors can identify areas of high risk, isolate outlier providers, and in many cases perform reviews of 100% of the claims under audit, thus significantly improving the integrity, efficiency, and effectiveness of our audits. Moreover, in many cases, data analytics has enabled the Unit to fully quantify the financial effects of improper payments, whether they involve 1 claim or 10 million claims. The use of data analytics techniques has enabled the Unit to: (1) identify greater cost recoveries and savings; (2) isolate weaknesses in MassHealth’s claim‑processing system, and; (3) make recommendations regarding MassHealth’s system and program regulations to promote future cost savings, improve service delivery, and make government work better.
Table of Contents
- Completed Audits
- Current Initiatives
- Medicaid Audit Unit Impact and Post-Audit Efforts
Office of State Auditor Diana DiZoglio
Help us improve mass.gov with your feedback.
The feedback will only be used for improving the website. If you need assistance, please contact the State Auditor . Please limit your input to 500 characters.
Thank you for your website feedback! We will use this information to improve this page.
If you would like to continue helping us improve Mass.gov, join our user panel to test new features for the site.
- Resume Builder
- Resume Experts
- Search Jobs
- Search for Talent
- Employer Branding
- Outplacement
While You Work - CPA Acceleration Program Audit Fellow - Summer 2023
Sign up & apply, job details.
A career within External Audit services, will provide you with the opportunity to provide a range of Assurance services and business advice to a variety of clients from small, fast growing clients to large entities. Our clients are often well known brands and many have broad international reach. We focus on using the latest technology to reduce the level of manual testing ensuring you’ll focus on the most valuable areas of client service and on enhancing corporate governance and the reliability of our clients’ information.
To really stand out and make us fit for the future in a constantly changing world, each and every one of us at Company needs to be a purpose-led and values-driven leader at every level. To help us achieve this we have the Company Professional; our global leadership development framework. It gives us a single set of expectations across our lines, geographies and career paths, and provides transparency on the skills we need as individuals to be successful and progress in our careers, now and in the future.
As a Specialist, you'll work as part of a team of problem solvers, helping to solve complex business issues from strategy to execution. Company Professional skills and responsibilities for this management level include but are not limited to:
- Conduct self in a professional manner and take responsibility for work and commitments.
- Flex approach to meet the changing needs of teams and clients.
- Identify and make suggestions for efficiencies and improvements when performing work.
- Take action to stay current with new and evolving technology.
- Use tools, techniques and firm standard methodologies to support research, analysis and problem solving.
- Handle, manipulate and analyse data and information responsibly.
- Communicate with empathy and adapt communication style to meet the needs of the situation and audience.
- Manage expectations of stakeholders effectively.
- Embrace different points of view and welcome opposing and conflicting ideas.
- Uphold the firm's code of ethics and business conduct.
Job Requirements and Preferences:
Basic Qualifications:
Minimum Degree Required:
Bachelor Degree
Required Fields of Study:
Accounting, Taxation, Finance, Business Administration/Management, Management Information Systems
Additional Educational Requirements:
To be eligible for While You Work, applicants must self-identify as Black or African-American or Hispanic or Latinx, which are traditionally underrepresented racial and ethnic minority groups within the professional services industry.
For more information about these requirements, please refer to Company’s While You Work website at the following URL: Company website
Minimum Years of Experience:
Certification(s) Required:
Before beginning fellowship with Company, will have completed 120 educational credits toward being eligible for the 150 credit requirement to sit for the CPA exam in certain states.
Preferred Qualifications:
Additional Educational Preferences:
Preferred cumulative GPA: 3.3
Preferred major GPA: 3.3
Client service fellowship positions are entry-level roles and job seekers typically need an additional 30 educational credits to complete the necessary 150 credit requirement to become a CPA.
Preferred Knowledge/Skills:
Demonstrates some abilities and/or a proven record of success in the following areas:
- All aspects of the assurance or tax profession and a desire to pursue a career in public accounting and taxation;
- Leveraging knowledge of financial accounting, managerial accounting, taxation, and financial reporting systems including generally accepted accounting principles, current accounting policies and procedures, and having general knowledge of federal and state tax laws in business situations;
- Applying business analytics to uncover errors, inconsistencies or opportunities for improvement in a variety of situations;
- Researching and analyzing technical literature, such as tax laws, rules regulations, accounting principles and policies pertinent in client, industry and technical matters;
- Using problem solving skills on business problems with creativity and an innovative mindset;
- Prioritizing tasks and projects, managing multiple tasks with agility;
- Interacting with various levels of client and firm management through both written and verbal communications;
- Taking responsibility for personal growth and development and is self motivated;
- Working in a team environment, and also function independently;
- Proactively seeking instruction, feedback and coaching to improve performance;
- Responding to client and/or team requests promptly and professionally;
- Readily offering assistance;
- Contributing to a positive, collaborative working environment;
- Prioritizing projects and manage multiple tasks with agility;
- Presenting information, both verbal and written, in a clear, concise manner;
- Innovating using new and existing technologies, along with experimenting with digitization solutions;
- Working with large, complex data sets to build models and leverage data visualization tools; and,
- Demonstrating some technical skills in MS Office (Word, Excel, Access, PowerPoint) and Google G-Suite products.
Company’s While You Work CPA Acceleration program is a paid part time fellowship through a collaboration between Company and Northeastern University. The fellowship combines real work experiences at the firm, as a specialist in Tax or Audit, and a tuition paid, online master’s degree program at the D’Amore-McKim School of Business.
Fellows complete Northeastern University’s academic requirements while working a part-time paid schedule at Company to gain valuable work experience.
- At completion of the program, fellows will have earned a Master of Science from Northeastern University.
- Participants will have earned credit hours to meet the 150 credit hour CPA licensure requirement.
- If accepted, you’ll join Company as a paid part-time fellow/specialist in audit or tax, a unique role between the traditional intern and associate levels.
- During your fellowship year, you’ll develop your accounting or taxation knowledge and grow your technical and leadership skills that are key to success in today’s workplace
- Fellows will be paid a salary and be eligible for overtime pay, based on work performed for Company. Fellows are not compensated for the time they dedicate to Northeastern University’s academic requirements.
- Fellows may be offered a full-time associate position at Company after the successful completion of the fellowship program.
At Company, our work model includes three ways of working: virtual, in-person, and flex (a hybrid of in-person and virtual). Visit the following link to learn more: Company website-we-work.
Company does not intend to hire experienced or entry level job seekers who will need, now or in the future, Company sponsorship through the H-1B lottery, except as set forth within the following policy: Company website-1B-Lottery-Policy.
All qualified applicants will receive consideration for employment at Company without regard to race; creed; color; religion; national origin; sex; age; disability; sexual orientation; gender identity or expression; genetic predisposition or carrier status; veteran, marital, or citizenship status; or any other status protected by law. Company is proud to be an affirmative action and equal opportunity employer.
For positions based in San Francisco, consideration of qualified candidates with arrest and conviction records will be in a manner consistent with the San Francisco Fair Chance Ordinance.
For positions in Albany (NY), California, Colorado, Nevada, New York City, Washington State, or Westchester County (NY), please visit the following link for pay range information: Company website-v1-assurancespecialist
Sign up and search through 93,625 curated jobs in the Finance & Investment Edition :
More interviews guaranteed in 30 days.
We guarantee that you will get more job interviews in 30 days after using our resume writing services or we will rewrite your resume for free.
DHS Financial Management: Actions Needed to Improve Systems Modernization and Address Coast Guard Audit Issues
There's still a lot of work to do to modernize the financial management systems at FEMA, Immigration and Customs Enforcement (ICE), and the Coast Guard within the Department of Homeland Security.
FEMA and ICE are in the planning phases of their modernization efforts. The Coast Guard has begun using a new financial management system—part of a larger $510 million modernization effort—but it's not working as expected.
Resolving issues identified during testing before moving on to the next phase would bolster modernization efforts. Our recommendations address this issue.
DHS financial management remains a topic on our High Risk List .

What GAO Found
The Department of Homeland Security (DHS) has defined and implemented a tiered governance structure to provide oversight of its financial systems modernization programs. In 2018, DHS also established the Joint Program Management Office to lead all aspects of the modernization programs, in partnership with DHS components. DHS has both department-level and program-specific plans to modernize financial systems. Financial systems modernization plans at selected DHS components include U.S. Coast Guard, Federal Emergency Management Agency (FEMA), and U.S. Immigration and Customs Enforcement (ICE), among others.
- Coast Guard deployed its new financial management system in December 2021 as part of a $510 million modernization program, and declared initial operational capability in June 2022. However, Coast Guard did not achieve expected full operational capability in December 2022. The program office is developing a remediation plan.
- FEMA and ICE are in the planning phases of their financial systems modernization efforts. In November 2022, DHS awarded contracts for software licenses and stated that it plans to award contracts for system integration services for these components.
Additionally, DHS established a process and continues to document and consider lessons learned from current and past modernization attempts. These lessons are to be shared with upcoming modernization programs.
Although DHS identified, documented, and tracked metrics to assess Coast Guard's system deployment, DHS found that the system was not achieving expected capabilities. This is because DHS did not address and remediate known issues identified in operational testing. DHS's subsequent operational testing and evaluation of the system found that it was not effective, responsive, or reliable. Therefore, DHS could not proceed to full operational capability of the system. It is now in the process of developing a remediation plan to address outstanding issues.
DHS risks not fully achieving its goal of deploying systems that produce reliable data for management decision-making and financial reporting if it does not remediate serious issues identified by testing. Resolving deficiencies identified by testing before proceeding to the next phase in the acquisition process can help reduce the risk that future system modernization efforts at FEMA and ICE will not meet mission needs or expected capabilities.
GAO also found that corrective action plans Coast Guard developed to address its fiscal year 2021 audit findings did not always contain all of the data attributes recommended in applicable guidance. For example, although DHS guidance emphasizes the importance of root cause analyses in resolving deficiencies, such analyses were often not done. Therefore, Coast Guard is at an increased risk that its corrective actions will not effectively address identified deficiencies.
Why GAO Did This Study
Since DHS's creation in 2003, it has faced significant internal control and financial management systems deficiencies. These issues contributed to GAO designating DHS financial management as high risk. To address its financial management issues, DHS is executing a multiyear plan, to include implementing modern financial management systems at its components, including Coast Guard, FEMA, and ICE.
In this report, GAO (1) describes the oversight, program management, plans, and lessons learned from past and current financial systems modernization efforts; (2) examines the extent to which the Coast Guard is achieving expected capabilities with its newly deployed financial management system; and (3) examines the extent to which Coast Guard has addressed audit findings related to financial reporting and IT system weaknesses.
GAO met with DHS officials, reviewed key documents and plans related to modernization efforts, and assessed Coast Guard corrective action plans to address fiscal year 2021 audit findings.
Recommendations
GAO is making four recommendations, including that the Joint Program Management Office work with Coast Guard, FEMA, and ICE to remediate issues identified by testing; and that Coast Guard follow applicable guidance when developing corrective action plans. DHS concurred with the recommendations and described actions it has taken and will take to address them.
Recommendations for Executive Action
Full report.
Paula M. Rascona Director [email protected] (202) 512-9816
Chuck Young Managing Director [email protected] (202) 512-4800
Mayor Sutcliffe to begin work on promised line-by-line audit this week

City council just passed its 2023 budget last week, but work is set to begin on a major mayoral campaign promise ahead of the 2024 budget.
Mayor Mark Sutcliffe promised a line-by-line audit of city spending in a bid to find money that could be spent elsewhere.
He told Newstalk 580 CFRA's CFRA Live with Andrew Pinsent this weekend that he intends to start the process this week.
"We're starting, as soon as Monday, we're starting a process of doing a strategic review of all city services and that's going to be an important line-by-line review of the budget," he said. "The goal there is to find some savings in some areas and to figure out ways that we can do things better and more efficiently so that we can free up some money to invest in the priorities that we establish."
Sutcliffe said the review would take place alongside a process to determine what council's priorities are for the 2022-26 term.
"I believe we need to zero in on two or three priorities, not have 20 or 30 priorities because then you don't have any priorities, so we've got to do that work to establish what those priorities are," he said.
The line-by-line review process would involve a working group that consists of the mayor, the chair of the audit committee—in this case, Coun. Cathy Curry—and a councillor-at-large.
"We're going to look at it from a value for money perspective, we're going to look at all the city services we deliver and make sure that we're delivering them effectively and they're having the greatest impact for residents," Sutcliffe said. "I'm hopeful that that will yield not just some savings but the potential to deliver services more effectively and more powerfully for residents and that we'll also be able, as a result of that, to reinvest in the areas of priority."
Curry said she wants to see every possible review performed, but added that the working group's recommendations would still need to be approved by committees and council.
"A working group can recommend whatever it wants; it will be up to the committees to decide what to do with it," she told councillors. "We're going line by line, programs and services, all of them; we're liaising with the auditor general. The working group has no power or authority; it's just a group doing work."
During the campaign, Sutcliffe said his goal was to find savings equal to one per cent of the budget. He's previously suggested finding savings through eliminating vacant non-essential jobs, attrition of non-essential staff, and reducing work with consultants and other external services and through the use of technology.
"It's not an exercise in cost-cutting," he told CFRA. "It's an exercise in unlocking savings so that we have more money to invest in the most important areas."
Ottawa Top Stories
New this morning | cleaning up latest snowstorm to take days, city says.

Court documents detail timeline leading up to Ottawa explosion

WestJet reducing direct service from Ottawa to Toronto starting in May

The top 10 riskiest scams for Canadians to watch out for

Sens' hot streak could spark new ownership announcement

Ottawa woman, man charged in 2021 death of infant boy

Police investigating after woman shows up at Ottawa hospital with gunshot wound

Trudeau tapping special rapporteur and two national security bodies to investigate foreign interference

CTVNews.ca Top Stories
Preparing for recession, canada's biggest banks put aside $2.5 billion for loan defaults.
Canada's six largest banks have put aside over $2.4 billion combined to cover potential losses, anticipating more Canadians will be unable to pay off loans and credit card debt as the country heads into an expected recession.

Facing pressure over rising concerns around foreign interference in Canada Prime Minister Justin Trudeau will be naming a new special rapporteur to investigate. Trudeau made the announcement on Monday as part of a suite of new measures aimed at addressing Canadians' concerns over alleged election meddling by China during the last two federal campaigns.
New research reveals face blindness may be more common than scientists believed
A new research found that face-blindness probably affects as many as three per cent of the world's population – significantly more people than initially believed.
Kim's sister warns North Korea ready to act against U.S., South Korea
The influential sister of North Korea's leader warned Tuesday that her country is ready to take 'quick, overwhelming action' against the United States and South Korea, a day after the U.S. flew a nuclear-capable B-52 bomber in a demonstration of strengthen against the North.
Canadian twins celebrate with world record on their first birthday
Defying the odds since birth, Canadian twins Adiah Laelynn and Adrial Luka Nadarajah celebrated their first birthday after being named the world's most premature twins.
Indonesia landslides kill 10, rescuers search for 42 missing
Rescuers were searching for 42 people still missing Tuesday after two landslides triggered by torrential rains hit villages on an island in Indonesia's remote Natuna regency, disaster officials said.
'It's beyond tragic': Family mourns B.C.'s Kiara Agnew, 23, after suspected murder in Mexico
The family of a B.C. woman who was found dead in Mexico on Friday is desperate to get her body home.
'Keto-like' diet may be associated with a higher risk of heart disease, according to new research
A low-carb, high-fat 'keto-like' diet may be linked to higher levels of 'bad' cholesterol and double the risk of cardiovascular events such as blocked arteries, heart attacks and strokes, according to new research.
RCMP investigating leaks alleging foreign election interference
The RCMP says it has launched an investigation into violations of national security information law in connection to media leaks of Chinese foreign interference allegations.
Protesters call for investigation after Palestinian students told to take off traditional scarves at Halifax school
About 50 people rallied outside the Nova Scotia education minister’s office Monday after students of Palestinian descent were allegedly told to take off cultural garments during a multicultural day at a school in Halifax last week.

Prince Edward Island premier calls provincial election for April 3
P.E.I. Premier Dennis King announced Monday night that the province will go to the polls on April 3, just under four years after his Progressive Conservatives were elected.
Staff under investigation after Black student, 6, allegedly locked in small room in Ontario elementary school
Three staff at an elementary school in Ontario are under investigation after a six-year-old Black student was allegedly separated from his peers and locked in a closet-sized room.

Ontario maple syrup producers hit by climate change, some urge carbon reductions
Increasingly unpredictable winter temperatures have Ontario maple syrup producers concerned about how climate change will affect the industry's future.
Family accuses city of 'negligence' after Toronto man breaks ankle after slipping on uncleared snow
Toronto resident Alvin Rebick won’t be walking anywhere for six to eight weeks after slipping on a snowbank and fracturing his ankle Sunday morning.
Man, 25, hospitalized with stab wounds after kidnapping in Dollard-des-Ormeaux: police
A 25-year-old man was sent to hospital with stab wounds after Montreal police say he escaped from a vehicle during a kidnapping Monday evening in the city's west end.

Teen files complaint against Hockey Quebec over alleged racist taunts
A minor hockey league player who says he was repeatedly subjected to racial slurs is filing a complaint against Hockey Quebec.
Montreal officer living double life as NHL emergency backup goalie
A Montreal police officer who grew up with dreams of playing in the NHL is finding a way to follow his dream... sort of. Patrick Chevrefils is an SPVM officer in Cote-St-Luc and swaps his badge for a blocker at night to sit as the emergency backup goalie.
Northern Ontario
Sudbury police charge man in violent attack at apartment building, second suspect still at large.
A 49-year-old man is charged with aggravated assault and forcible confinement after a violent attack at an apartment building on Bruce Avenue in the Flour Mill area of Greater Sudbury, police say.

An Ottawa woman and a man have been charged in the death of a seven-week-old infant a year and a half ago.
'Improper communication' delays start of Sudbury murder trial Monday
The start of a second-degree murder trial in Sudbury on Monday was delayed until the afternoon because of an attempt at 'improper communication with the jury.
An update on CTV's Stephanie Villella
As of Monday, Stephanie remains in hospital with her family by her side.

Firefighter injured while tackling blaze in central London, Ont.
A firefighter was sent to hospital after responding to a fire at an abandoned home located on Grey Street Monday afternoon. Emergency crews responded to 253 Grey. St. for reports of a structure fire that had 'heavy smoke showing on all sides.'
Paratransit fails to get some disabled Londoners to meeting about fixing dysfunctional system
The point was made before the first word was uttered. On Monday, some disabled paratransit riders who wanted to attend a London Transit Commission meeting about improving service were unable to book a ride to get there.
15-year-old dead, another in hospital after shooting in Winnipeg
Winnipeg police say a 15-year-old male was killed in a shooting on Amherst Street in St. James early Monday morning.

Three hospitalized, home significantly damaged following 'chaotic' party at rental home: Manitoba RCMP
Headingley RCMP is investigating after a "chaotic" party broke out near the end of February at a rental home that resulted in three people going to hospital and the house receiving thousands of dollars in damage.
Mark Chipman's company looking at buying Portage Place mall
The ownership group of the Winnipeg Jets may soon become the new owners of Portage Place mall in downtown Winnipeg, with plans to redevelop the area.
Kitchener rapper picks up first-ever Juno nomination
From Kitchener to cross-country recognition, a rapper from the city is nominated for the Juno Awards’ rap single of the year.

Driver suffers stab wounds after fight with another motorist in Kitchener
Waterloo regional police said a male has been taken to hospital with stab wounds after he was involved in a fight with another driver near a Kitchener intersection.
Why Smith says there was no money to revitalize downtown Calgary in Budget 2023
Alberta Premier Danielle Smith says Calgary Mayor Jyoti Gondek did not provide a 'priority list' with her asks for Budget 2023.

'Shock and disbelief': Notley and Smith spar over worried, leaked email about EMS changes
A unit manager at a hospital in Calgary wrote that they are "shocked and speechless" about a plan to have paramedics drop off patients and return to the streets in 45 minutes, something Alberta's premier downplayed as a "target" and the way it used to be.
Search underway for Calgary woman last seen in Forest Heights
The Calgary Police Service is asking for help from the public as investigators attempt to locate a missing woman.
Sask farmer growing tropical foods in his passive solar greenhouse
Saskatoon-area farmer Dean Sopher has always looked for ways to be self-reliant.

'Everybody was having fun': Witness testifies how a family gathering turned deadly for Sask. man
A 23-year-old man from Hall Lake is accused of second-degree murder in the death of a 29-year-old La Ronge man. He stood trial at the Prince Albert Court of King’s Bench on Monday.
Police staff tells Saskatoon woman being followed by suspicious car to pull up to police station
A 35-year-old Saskatoon man was charged with dangerous driving and possession of stolen property after a woman reported her vehicle was being followed early Sunday morning.

McDavid scores twice in Oilers' 3-2 win over Sabres
Connor McDavid scored twice, giving him an NHL-leading 54 goals this season, and the Edmonton Oilers beat the Buffalo Sabres 3-2 on Monday night.
From high school to the Oscars: Edmonton-area actress headed to LA for role in best picture nominee
Kate Hallett, 18, is in the film Women Talking, nominated for Academy Awards in best picture and best adapted screenplay.
'It’s challenging': Issues persist as B.C. modernizes hospital technology
British Columbia’s two biggest health authorities are pushing ahead with the massive task of modernizing the information technology systems in their hospitals, with issues already plaguing the effort.

'Absolutely disgraceful': Vancouver MP reacts to killer’s claim his victim is still alive
The man convicted of killing Amanda Zhao in 2002 is living in New Zealand, and told media there that his victim is still alive. A B.C. member of Parliament and Zhao's family are disgusted and outraged by the claims.
Virtual option included for first time in Metro Vancouver homeless count
For the first time ever, a virtual option will be available for people participating in a survey for the Metro Vancouver homeless count.
Regina man struck in head with toilet tank lid in nightclub assault
A 25-year-old man is recovering in a Regina hospital after an apparently unprovoked attack where he was hit in the head with a toilet tank lid in a nightclub washroom, according to his mother.

'Not the ideal situation': Province concerned with proposed boundary change due to overcrowding
Over the weekend, the Regina Public School Board announced a proposed boundary change that would affect about 200 students at Harbour Landing School, something the provincial government finds concerning.
$10-a-day child care coming to Sask. this spring
Fees for licensed child care in Saskatchewan will drop to $10 a day this spring.
- Sign Up For eNewsletters
- Where to purchase
- Robesonian on Instagram
- Robesonian on Facebook
- Robesonian on Twitter
- Online Community
- Special Sections
- Submit Scores
- Submit Sports News
- AP Olympics Coverage
- Auto Racing
- College Basketball
- College Football
- Public Notices
- Community Photo Gallery
- Feature Video
- Games & Puzzles
- Submit Anniversary
- Submit Birthday
- Submit Engagement
- Submit Wedding
- Submit Military Promotion/Graduation
- Wedding Specialists
- TV Listings
- TV Best Bets
- Business Directory
- Advertise With Us

- Place A Garage Sale Ad
- Android App
- iPhone/iPad App
- Add Your Event
- Advertiser Pay
- Readers’ Choice 2022
PSRC Federal Programs Department receives clean audit
Jessica Horne Special to the Robesonian

Courtesy photo | Public Schools of Robeson County

LUMBERTON — The Public Schools of Robeson County recently received a clean audit of the district’s Federal Programs Department by the North Carolina Department of Public Instruction.
“Robeson County Public Schools has successfully met all statutory compliance requirements in the review conducted by the North Carolina Department of Public Instruction that occurred the week beginning February 23, 2023,” according to a letter sent on February 28 to Public Schools of Robeson County Superintendent Dr. Freddie Williamson by NCDPI’s Federal Program Monitoring and Support Division.
There were no findings in the audit which took a comprehensive look at the district’s implementation of federal programs listed as Title I Part A, Title I Part C, Title I Part D, Title II Part A, Title III and Title IV Part A.
Federal funding, specifically Title I funding, is intended to help ensure that all students have the opportunity to receive a high-quality education and reach proficiency on challenging state academic achievement standards and assessments in core subjects such as reading and math. The funding is supplemental, which means that the service or resource it funds cannot replace core instruction, but that it must support core instruction.
“A Federal Programs Audit with zero findings is a testament to the hard work that has gone into ensuring that our students are supported and prepared for school and the challenges life brings,” said Jennifer Freeman, Assistant Superintendent of Student Services, Intervention and Support at PSRC.
The Public Schools of Robeson County’s Federal Programs Department will continue to focus on the three strategic priorities of Reading, Math and Multi-Tiered System of Support (MTSS).
The specific goals include meeting the educational needs of all students, improving and strengthening accountability, teaching, and learning and afford parents substantial and meaningful opportunities to participate in the education of their children. The Public Schools of Robeson County’s “Turn Around” work with Relay connects with the strategic priorities and goals of the Federal Programs Department.
“The bar has been set really high by Mrs. Freeman, and we will continue ensuring that all students have their needs met and that we are utilizing federal funds effectively to achieve that task,” said Philip Oxendine, Director of Federal Programs at PSRC.
“We applaud the work of our Federal Programs Department professionals and we commend them for their diligence and commitment to the work that impacts our students every day. The audit results are an indicator of what we already know, our Federal Programs staff members are top-notch,” said PSRC Superintendent Dr. Freddie Williamson. “We will continue our work across departments to provide all students with a sound basic education and with opportunities they can use to become productive citizens in our communities and in our world.”
Jessica Horne, Chief Communications Officer, Public Schools of Robeson County, can be reached at 910-671-6000.
RELATED ARTICLES MORE FROM AUTHOR

N. Carolina governor talks prosperity, culture war warning

Retiring Red Springs town manager looks back

Stiles: Lady Braves overcome it all to win title
Editor's picks.

Downtown Lumberton centerstage during annual Rumba – PHOTOS

PSRC leaders continue defense of El Curriculum

IMAGES
VIDEO
COMMENTS
Preparing the Audit Program Once internal audit has confirmed their understanding of the process and risks within the process, they will be prepared to create an audit program. An audit program should detail the following information: Process Objectives Process Risks Controls Mitigating Process Risks Control Attributes, including:
AuditNet ® Audit Programs Download a listing of Audit Programs Access to Premium templates is available only to customers of Workiva's GRC solutions. Please click on the link to learn more about Workiva's industry leading GRC solutions can help your audit team be more efficient and impactful.
An audit program is a system of audit objectives, scope, timeline, and activities that will be carried out by auditors. An audit program, also known as an audit plan, functions as a guide for conducting various types of audits in a company. Why do Audit Programs Matter? Audits evaluate the effectiveness of an organization's internal controls.
The Ransomware Readiness Audit Program is designed to assist senior management, auditors, and information/cybersecurity practitioners with resources to support readiness efforts. Learn More Audit Programs and Tools Filters 16 of 64 Results Audit Program COBIT for DevOps Audit Program | Digital | English
1. Prepare an audit engagement letter and distribute to appropriate management. 2. Hold an opening meeting with management. 3. Update the Work Program based on changes to the regulation or prior audit recommendations. Review Procedures Policy/Procedures 1. Obtain and review any written policies, standards,
Internal and External Audit Programs. Each institution should have an internal audit program that is appropriate to its size and the nature and scope of its activities. When properly structured and conducted, internal audit programs provide vital information about risks and controls so management can promptly address any identified weaknesses.
Objectives of Audit Program Types of Audit Program #1 - Standardized Audit Program #2 - Tailored Audit Program #3 - Compliance Audit Program #4 - Fixed or Flexible Audit Program Audit Program Samples Frequently Asked Questions (FAQs) Recommended Articles Key Takeaways Audit programs are tools that help auditors determine a course of action.
An ESG audit will help to determine the specific moves your company needs to take to shut down risks and capture opportunities most relevant to its goals. An ESG audit will also verify the accuracy of your ESG-related disclosures. Download our ESG Audit Checklist are some best practices to help you identify ESG risks and establish ESG controls.
In an audit program, it is an important tool to ensure accuracy in the represented transactions of the body. It is either done by the employees of the organization internally or externally by an outside body. Table of Content 11+ Audit Program Templates in PDF | DOC 1. Audit of Fixed Assets Audit Program Template 2. Sample Audit Program Template 3.
Example Internal Audit Work Program / Risk and Control Matrix (RCM) Maintaining appropriate controls over an accounts payable process, such as ensuring invoices are only paid when a valid three way match is completed and appropriate approval is received, is important to ensure there is no fraud, the business is meeting any local regulatory requirements and the business is making best use of ...
An audit program, also called an audit plan, is an action plan that documents what procedures an auditor will follow to validate that an organization is in conformance with compliance regulations. The goal of an audit program is to create a framework detailed enough for any outside auditor to understand. It should contain the following information:
This sample audit program provides the internal audit team with guidance and direction when executing audits of projects and/or program management office activities. This work program is intended to provide the audit team with an overview of some basic background and concepts associated with projects and programs, and the dependencies ...
Course Description. Developing an audit work program can be a daunting process, especially when the audit area is one with which the auditor is unfamiliar, and/or has not been audited previously. This course will take the mystery and pain out of the process by introducing a methodology called "Closing the Loop Framework".
failed to meet work search requirements have been the primary cause of UI overpayments. The Department estimates that, between April 1, 2017, and March 31, 2018, states overpaid more than $1.4 billion in UI benefits to recipients who did not meet state work search requirements for the UI program. This audit will assess
An audit program is a set of directions that the auditor and its team members need to follow for the proper execution of the audit. After preparing an audit plan, the auditor allocates the work and prepares a program which contains steps that the audit team needs to follow while conducting an audit.
Auditing is defined as the on-site verification activity, such as inspection or examination, of a process or quality system, to ensure compliance to requirements. An audit can apply to an entire organization or might be specific to a function, process, or production step. Some audits have special administrative purposes, such as auditing ...
An audit program is a set of policies and procedures that dictate how an evaluation of a business is done. This generally involves specific instructions on how much the evidence must be collected and evaluated, who will collect and analyze the data and when this should be done.
What are the 5 stages of an audit? Audit work plan stages include: planning, executing, observing, reporting, and closing. Planning is the highest-level step in an audit. This stage consists of defining the scope of your review, what you are looking for in the records you're auditing.
An audit program is a checklist of the audit procedures that must be followed by an auditor in order to complete an audit. An auditor signs off on each checklist item as it is completed, and then inserts the audit program into the audit working papers as evidence that audit steps were completed.
Office of Inspector General - U.S. Department of Labor
Fellows complete Northeastern University's academic requirements while working a part-time paid schedule at PwC to gain valuable work experience. At completion of the program, fellows will have earned a Master of Science from Northeastern University. Participants will have earned credit hours to meet the 150 credit hour CPA licensure requirement.
It should align with audit objectives and contribute to the act of curating an audit work plan. What is audit plan and program? An audit design contains a list of guidelines for auditors to follow while conducting an audit. In contrast, an audit program is the description of detailed steps to complete the audit procedure. ...
Create a Workers' Comp Audit Checklist. Auditors need financial information for the period covered by your workers' compensation policy. To prepare for your workers' compensation audit, consider creating a workers' compensation audit checklist to help keep track of: 4. 1. Employee information, including Form 941 for policies with ...
Smartsheet is a work execution platform that enables healthcare companies to improve auditing processes, manage external rules and regulation information, and track and store historical records in one centralized location, while meeting or exceeding all of HIPAA's regulatory requirements.
Annual Report Medicaid Audit Unit for March 2, 2022 through March 1, 2023. A review of the work conducted by the Office of the State Auditor's Medicaid Audit Unit over the past year. It highlights audits released, audits in progress, and the impact of the Unit's work. Organization: Office of the State Auditor. Date published:
Company's While You Work CPA Acceleration program is a paid part time fellowship through a collaboration between Company and Northeastern University. The fellowship combines real work experiences at the firm, as a specialist in Tax or Audit, and a tuition paid, online master's degree program at the D'Amore-McKim School of Business.
In this report, GAO (1) describes the oversight, program management, plans, and lessons learned from past and current financial systems modernization efforts; (2) examines the extent to which the Coast Guard is achieving expected capabilities with its newly deployed financial management system; and (3) examines the extent to which Coast Guard ...
Mayor Sutcliffe to begin work on promised line-by-line audit this week. City council just passed its 2023 budget last week, but work is set to begin on a major mayoral campaign promise ahead of ...
"A Federal Programs Audit with zero findings is a testament to the hard work that has gone into ensuring that our students are supported and prepared for school and the challenges life brings ...