Thank you for the comment. Audits can vary in scope and complexity, making it difficult to anticipate a timeframe during the initial planning period. This difficulty can be further complicated by factors outside of Internal Audit’s control, such as the number of audit issues (findings) identified, and client readiness and response times. Audit follow-up times also depend on the client’s successful implementation of agreed-upon action plans. While Internal Audit seeks to be efficient in performing audits, we do not feel that putting timeframes in policy makes sense at this time.

Thank you for the comment. This suggestion makes sense and will be incorporated.

Should there be language that anticipates or clarifies a typical audit’s duration? Everywhere else I’ve worked has had audits in the 3-6 month range, occasionally spilling a little longer. We have audits that can last well over a year at SLCC

The Records Management policy addresses retention schedules and GRAMA. Suggestion to rephrase 4.D. for clarification and alignment with other college policies. Perhaps, “Internal Audit shall comply with the college’s Records Management Policy, GRAMA, and other relevant laws.” And include a hyperlink to the Records Management Policy.