Audits

Audit Opinions

Audit opinions relate to the process being audited, and do not reflect an overall opinion for EDC. There are four audit opinions.

• Strong controls: Key controls are effectively designed and operating as intended. Internal control system is comprehensive, well developed, and well understood by Management and staff. Objectives of the audited process are most likely to be achieved.
• Well controlled:Key controls are effectively designed and operating as intended. Objectives of the audited process are likely to be achieved.
• Opportunities exist to improve controls: One or more key controls do not exist or are ineffective. Objectives of the process may not be achieved. The risk of loss to the audited process is significant. Timely action is required.
• Not controlled: Multiple key controls do not exist or are ineffective. Objectives of the process are unlikely to be achieved. The risk of loss to the audited process is material. Action must follow immediately.

Audit Findings

• Major: A key control does not exist, is poorly designed or is not operating as intended and the financial and/or reputation risk is more than inconsequential. The process objective to which the control relates is unlikely to be achieved. Corrective action is needed to ensure controls are cost effective and/or process objectives are achieved.
• Moderate: A key control does not exist, is poorly designed or is not operating as intended and the financial and/or reputation risk to the process is more than inconsequential. However, a compensating control exists. Corrective action is needed to avoid sole reliance on compensating controls and/or ensure controls are cost effective.
• Minor: A weakness in the design and/or operation of a non-key process control. Ability to achieve process objectives is unlikely to be impacted. Corrective action is suggested to ensure controls are cost effective.

Audit Follow-up Process

As required by the standards of the Institute of Internal Auditors, Internal Audit monitors the disposition of audit engagement results communicated to management to ensure that action is taken on a timely basis. Follow-up testing is performed on a quarterly basis to ensure appropriate implementation of action plans. Follow-up audits assess the overall implementation rate of management’s action plans. A high implementation rate across the organization signifies management’s commitment to the continuous improvement of internal controls. A report is issued for follow-up audits using the following rating scale:

• Strong:100% of the audit recommendations due to be implemented in the current quarter were completed.
• Well controlled: 70% - 99% of the audit recommendations due to be implemented in the current quarter were completed.
• Opportunity Exists to Improve Implementation Rates: 50% - 69% of the audit recommendations due to be implemented in the current quarter were completed.
• Not controlled: less than 50% of the audit recommendations due to be implemented in the current quarter were completed.