CONDUCTING INTERNAL AUDIT ACTIVITY

a) Planning

The planning process in internal audit consists of defining the audit universe, determining the areas of audit, defining risk criteria, evaluating risks, prioritizing audit areas, allocating audit resources, and preparing and approving the audit plan and program.

It is essential for internal audit to be risk-focused. By continuously measuring and evaluating the risks that public institutions may be exposed to, areas that may pose a high risk are identified, and an internal audit plan and program are prepared accordingly. Internal audit is conducted in accordance with this plan and program.

The internal audit plan is prepared to ensure the effective, efficient, and economical conduct of the audit, taking into account the scope and subjects of the audit, the necessary workforce, and other resources. The internal audit plan prepared every three years is reviewed annually and modified as necessary.

The prepared plan and program are put into operation with the approval of the senior management. Furthermore, after the assignment of internal auditors, a notification letter is sent to the units to be audited by the internal audit unit.

b) Conducting the Audit

The audit activity begins with preliminary work and includes the determination of audit objectives, information gathering/preliminary research, and the opening meeting phases. Based on the information obtained, audit objectives are finalized, potential problematic areas are identified, and an individual work plan is prepared by specifying the scope of the audit.

Before conducting the audit, the internal auditor gathers the necessary information. At the beginning of the audit, a meeting is held with the managers of the unit to be audited and the necessary personnel's participation.

After completing the information gathering and preliminary research phase, the internal auditor, based on the data obtained, identifies potential problematic areas related to the unit and processes as a result of risk assessment.

To obtain the required information, auditors may conduct interviews with the employees of the audited unit.

Following the creation of findings, the auditor sends the audit findings, along with a letter, to the unit being audited to be discussed in the closing meeting.

The auditor and the audited unit discuss the audit findings and the recommendations developed in a closing meeting and record the results in a report.

c) Reporting

Reporting on audit activities is carried out in accordance with the public internal audit reporting standards issued by the Internal Audit Coordination Board.

Taking into account the discussions on the audit findings between the auditor and the audited unit in the closing meeting, the auditor prepares a draft audit report.

The auditor submits the draft audit report, along with a letter, to the head of the unit subject to the audit, with the request to respond within a specified period. The unit manager responds to the report within the specified time frame, and if necessary, gathers the opinions of the employees and relevant individuals.

If the auditor and the unit manager agree on the importance and level of risks, they reach an agreement on taking measures within a reasonable period, and these actions are included in an action plan by the audited unit.

The internal auditor presents the final report, including responses received from the audited unit and their evaluations, through the internal audit unit to senior management.

Internal auditors prepare audit reports for all types of compliance, performance, financial, information technology, and systems audit activities and investigation reports for activities conducted within the scope of consultancy.

d) Monitoring and Evaluation

Corrective actions and recommendations proposed by the auditor as a result of the internal audit activity are carried out within the specified period mentioned in the relevant report. If the corrective action requires a certain amount of time, this is stated in the response to the audit report, and periodic developments are reported to the internal audit unit at least every six months.

Whether the measures mentioned in the report are taken is monitored by the senior management. The senior management can also perform this task through the internal audit unit.

The actions taken or the reasons for not taking any action based on the report are sent to the internal audit unit to be reported to the internal auditor by the units being audited.

A summary of the prepared report, along with the actions taken on the final report, is sent to the Internal Audit Coordination Board within two months of the date the report is presented to senior management. Additionally, a copy of the report is also sent to the Strategy Development Presidency.