Audits and Evaluations FAQs

A: An audit conforms to the Government Accountability Office's Government Auditing Standards which require that we plan and perform the audit to obtain sufficient, appropriate evidence that will provide a reasonable basis for our findings and conclusions based on our audit objectives. Evaluations conform to the Council of Inspectors General on Integrity and Efficiency's Quality Standards for Inspection and Evaluation which defines inspections and evaluations simply as reviews that do not constitute an audit or a criminal investigation. (For further details, please see FAQs About OIG Investigations​.)

A: Audit and evaluation objectives may vary widely—a review might even have more than one objective. Objectives can include:

• assessments of program effectiveness, economy, and efficiency;
• internal control, which include​s the plans, policies, methods, and procedures adopted by management to meet its missions, goals, and objectives;
• compliance with laws and regulations; or
• prospective analysis.

A: Each year, we conduct a risk assessment of Department programs. Based on each year's risk assessment, we develop an audit plan outlining the work we intend to accomplish during the next fiscal year. The plan is modified during the year as necessary to respond to unanticipated requests and issues. We may decide to perform an audit based on a number of factors:

• It may be required by law. For instance, every year we assess the effectiveness of the Department's information technology (IT) security controls as required by the Federal Information Security Management Act of 2002.
• It may be requested. If an issue or program is of interest to Congress, the Secretary of Commerce, or the current administration, they may ask us to perform an audit or evaluation.
• Some audits or evaluations are based on issues we have determined to be a high priority for the Department or operating unit, as communicated in our annual Top Management Challenges report to the Secretary and Congress.
• We may initiate an audit or evaluation if we uncovered significant issues during a previous review, or if we have determined that the program or office is of higher risk.

A: After we decide to perform an audit or an evaluation and the project is approved by our management, we follow this process:

• issue an announcement memo to the operating unit,
• hold an entrance meeting with the operating unit and stakeholders,
• conduct fieldwork and analyze results,
• hold an exit conference with the operating unit and stakeholders,
• prepare and issue a draft report, and
• prepare and issue a final report.

Upon receipt of the final report, an agency must submit an action plan outlining plans to address our recommendations.

A: The elements needed for an issue to be considered a finding depend on the objectives of the audit. An effect (or potential effect) of a risk, a lack of internal control, a quality-control issue, or another problem may demonstrate the need for corrective action.

A: Yes, although the form may vary. We usually discuss preliminary findings with agency staff as we identify them during our fieldwork. Agency staff can, and should, work with us during fieldwork to ensure that our information is factually correct and to promptly resolve any issues or miscommunications.

After fieldwork, we generally hold an exit conference with agency officials to discuss what we found and solicit feedback. Following the exit conference, we issue a draft report. Under our professional standards (and the particular circumstances), an agency is given a timeframe  to provide us with written comments that include, for each recommendation, a statement of agreement or disagreement. An agency can use its response to provide a proposed action or updates on steps already taken to address OIG’s recommendations or to point out areas of disagreement with our findings or recommendations. However, an agency must support any disagreements included in the response.

We will consider the agency’s response to the draft as we create our final report and will revise the report as appropriate. In most cases, we will include agency comments as an appendix to the final report.

A: While it depends on the individual project, we generally issue a final report within a year after the audit announcement date. However, we may shorten or extend this timeline​.​​

• based on the significance of the issues we uncover,
• when Congress requests a report by a particular date, or
• if the operational timeline for the area under audit chang​​es (if, for example, we are auditing certain milestones of a program and the milestone dates are extended).

A: The head of the operating unit or office being audited or evaluated and any other stakeholders receive a PDF of the report via e-mail. We also send PDFs of reports to staff on the pertinent Congressional committee or subcommittee. Finally, we post a PDF of the report on the OIG website for public viewing. If the report contains proprietary information or other information that is not appropriate for public release under applicable law, it may be redacted before we post it, or we may clear only the abstract of the report (what we call a Report in Brief) for public release.

A: When we issue the final report, we request in the transmittal memorandum that the auditee prepare an action plan to address the report's recommendations. The plan should describe the specific actions the agency has taken, or plans to take, in response to our recommendations, as well as a schedule for their completion. Department Administrative Order 213-5 allows the agency 60 days to provide the plan (unless we state otherwise in the memorandum).

Any questions or issues may be addressed with OIG’s Principal Assistant Inspector General for Audits and Evaluations, Mark Zabarsky, at mzabarsky@oig.doc.gov​