Single Audit: In the United States, the Single Audit, also known as the OMB A-133 audit, is a rigorous, organization-wide audit or examination of an entity that expends $750,000 or more of Federal assistance (commonly known as Federal funds, Federal grants, or Federal awards) received for its operations. Usually performed annually, the Single Audit’s objective is to provide assurance to the US federal government as to the management and use of such funds by recipients such as states, cities, universities, and non-profit organizations. The audit is typically performed by an independent certified public accounting firm and encompasses both financial and compliance components. The Single Audits must be submitted to the Federal Audit Clearinghouse along with a data collection form.

Auditee: Any individual, unit, or activity of the organization that is audited.

Audit scope: The activities covered by an internal audit, which may include, when appropriate: 

• Audit objectives 
• Nature and extent of auditing procedures performed 
• Time period audited 
• Related activities not audited in order to delineate the boundaries of the audit

Audit evidence: Facts gathered during the audit procedures that provide a reasonable basis for forming an opinion or making a conclusion. Audit evidence is data/information gathered during the audit to (1) measure, compare and evaluate, (2) meet audit objectives, and (3) support audit conclusions and judgments. IAO’s audit evidence is documented in working papers.

Audit finding: A significant issue is identified during the audit. Findings include criteria or basis for determining that a problem does exist, a condition or situation that was observed, the effect or impact of the condition, and the root cause of the problem to the extent that it can be determined. Findings should result in recommendations that resolve the issue and are helpful to management.

Questioned costs: Cost that is questioned because of (a) an alleged violation of a provision of a law, regulation, contract, grant, cooperative agreement, or other agreement or document governing the expenditure of funds; (b) a finding that, at the time of the audit, such cost is not supported by adequate documentation; or (c) a finding that the expenditure of funds for the intended purpose is unnecessary or unreasonable.

Conflict of interest: Any relationship that is or appears to be not in the best interest of the organization. A conflict of interest would prejudice an individual’s ability to perform his or her duties and responsibilities objectively.

Segregation of duties (Separation of duties): An internal control designed to prevent error and fraud by ensuring that at least two individuals are responsible for the separate parts of any task. 

Control Environment: The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.

Control Activities: The policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

Risk Assessment: Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

Information and Communication: Pertinent information must be identified, captured and communicated in a form and time frame that enable people to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting.

Monitoring: Internal control systems need to be monitored--a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

Fraud: Fraud and related misconduct prohibited by this policy generally involves a willful or deliberate act or failure to act with the intention of obtaining an unauthorized benefit. Such acts include, but are not limited to:
making or altering documents or computer files with the intent to defraud
purposely preparing inaccurate financial reporting
misappropriation or misuse of resources, such as funds, supplies or other assets
improper handling or reporting of money transactions
authorizing or receiving compensation for goods not received or services not performed
authorizing or receiving compensation for hours not worked.

Institute of Internal Auditors (IIA): is the internal audit profession's global voice, recognized authority, acknowledged leader, chief advocate, and principal educator. Generally, members work in internal auditing, risk management, governance, internal control, information technology audit, education, and security.

Committee of Sponsoring Organizations of the Treadway Commission (COSO): A joint initiative of five private sector organizations, established in the United States, dedicated to providing thought leadership to executive management and governance entities on critical aspects of organizational governance, business ethics, internal control, enterprise risk management, fraud, and financial reporting. COSO has established a common internal control model against which companies and organizations may assess their control systems.