 |
How are licensees selected for an audit? |
| |
Each year the Internal Auditing Unit prepares an audit plan based on RCGC management input and an assessment of a licensee's perceived audit risk. Our risk assessment analysis has the following factors:
- When applicable, audit history which considers prior findings and/or the date of the last audit.
- RCGC concerns based on past non-compliance by licensee with rules and regulations, history of warning letters issued or complaints received.
- Reliance on information technology which considers system security and data accuracy vulnerabilities.
- Transaction volume which determines the financial size of the licensee.
|
| |
|
How long do audits take? |
| |
It depends on the depth and scope of the engagement. Generally speaking, full-scope audits could take anywhere from two to six months, depending on the size and complexity of the licensee under audit.
|
| |
|
What should a licensee expect during an audit? |
| |
- An entrance conference is held to officially start the audit. The purpose is to explain the audit process, gather information, describe the scope and objectives, and establish a cooperative working relationship with the licensee.
- In the fieldwork phase, the auditors gain an understanding of operations under review, assess the internal control structure, and perform detailed testing to verify compliance with policies and/or regulatory compliance standards.
- Communication includes a discussion of the draft audit findings with the licensee to obtain clarification. The draft report is presented for licensee's review and comment prior to final publication.
- Active discussion and interaction with licensee's prior to issuing the final report is standard protocol.
- An exit conference signals the official end of the audit. The auditor comments and recommendations are again reviewed. The final report, including licensee responses, serves as the final product of the audit process.
|
| |
|
How can the licensee facilitate the audit process? |
| |
Be honest and open; understand that the RCGC IAU does serve to assist you and your organization by recommending solutions that can hopefully save your organization time and money, while ensuring your operation has sound business practices and is in compliance with RCGC rules and regulations. We ask that you participate in the audit process and discussions. It is important that you not only voice your opinions regarding areas of weakness and issues of concern, but also give an honest assessment of the anticipated effectiveness and feasibility of our proposed suggestions for improvement. |
| |
|
What if something isn't handled correctly? |
| |
We will make recommendations for improvement. It is the responsibility of management to weigh possible additional costs of implementing our recommendations in terms of benefits to be derived and the relative risks involved. |
| |
|
Can a licensee request an audit? |
| |
Yes! We consider requests for audit work, although our ability to perform the audit might be affected by our staffing levels. However, if you are concerned about an area in your organization, we will try to make time for a limited examination of the area. |
| |
|
Who will receive copies of my audit report? |
| |
Copies of audit reports are provided to the RCGC Commission at a public meeting. Audit reports become a public document upon approval by the commission at the public meeting. Audit work papers and notes, however, are not public records. Work papers shall include, but are not limited to, all preliminary drafts and notes used in preparing the audit report. |
| |
|
What are internal auditors looking for? |
| |
Primarily, the IAU looks for compliance with RCGC rules/regulations and state statutes including proper payments to the state and charities as required by law, and sound internal controls. RCGC audits are designed to help ensure all organizations comply with applicable laws and regulations and operate efficiently. By following these policies we help protect the organizations from unnecessary risks and help ensure sound business practices are consistently followed by RCGC licensees. However, not all internal controls can be codified in rules or regulations. If we find control weaknesses, we regularly make recommendations to implement a control even though it may not be specifically required by rule or statute. |
