FY 2020 Audit Plan Kickoff July 15, 2019 Jennifer Walker, Chief Audit Officer Molly Murphy, Internal Audit Manager

2

About Us Mission: To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight. Vision: * To be a respected campus partner whose advice is sought and whose integrity is beyond reproach, * with a highly skilled and professionally credentialed staff * to provide unbiased evaluations with actionable recommendations, * continuously seek to improve internal operations and service delivery through quantitative and qualitative evaluations and measurements. 3

What do we do? - Audits - Investigations - Advisory Services - Training Sessions - Committee Service (Searches, Governance, Advisory) Check out our website for more information: internalaudit.uncc.edu 4

Guidance Institute of Internal Auditors’ International Professional Practices Framework 5

Risk-based auditing Performance Standard 2010: The Chief Audit Executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals. Methodology that links audit projects to higher risk areas within the University 6

Annual Audit Plan Development Process Internal Audit Issues - Spring 2016 Annual Audit Plan Development Process Review current year plan deferred / cancelled projects. Conduct risk assessment survey & interviews. Analyze data. Present draft plan to Chancellor for approval. Adjust draft based on management input. Present final plan to the ACERM Committee for approval. Execute approved audit plan. We are here. 7

How do we choose what to audit? Feedback from members of the ACERM Committee. Feedback from the Chancellor / Cabinet. Time since the last audit. Number of findings in the last audit. Dollar-value of transactions processed through the area. Complexity of the unit. Changes in policies, rules, regulations. New systems. 8

Internal Audit Issues - Spring 2016 Annual Audit Plan – FY20 - Athletic Ticket Revenue - EHSO-Radiation Safety - Accreditation Review - Admin Review-Student Affairs - Emergency Response/Crisis Communication - Admin Review-Business Affairs - ADA Compliance-Disability Services - NCAA Football Attendance - Data Security Plans Verification - IT/Cyber Security Review - General Computer Controls - IT Risk Assessment - Internal Controls Testing - I-9 Verification

The Anatomy of an Audit Planning Research Gaining an Understanding Testing Conclusion and Wrap-up 10

I. Planning Notify client Planning Meeting (if needed) Entrance Meeting Risk / Fraud Risk Assessment Develop Audit Program Obtain CAO approval of Audit Program 11

When Internal Audit visits… Internal Audit Issues - Spring 2016 When Internal Audit visits… We schedule an entrance meeting with the Director/Vice Chancellor (VC) of the department being audited. We provide a list of items that we need for review, based on the nature of the audit. A timeline is established – typically 6 to 8 weeks. Review preliminary risk assessment or scope and time-period for the audit. During the course of the audit, we will contact you regularly with questions and updates – we encourage you to ask questions, too! 12

II. Research Review prior audit workpapers. Federal regulations, North Carolina General Statutes, UNC System policies, UNC Charlotte policies. Association of College & University Auditors (ACUA) Risk Dictionary and Audit Program Library. 13

III. Gaining an Understanding Review applicable guidance identified during research. Interview client (usually multiple meetings with various personnel in the campus unit). Review client’s documented procedures. Identify key controls for selected audit objectives. 14

IV. Testing Test aspects of the client’s internal controls and operations. Tests line up with audit objectives and identified risks to offer reasonable assurance as to whether operations are functioning as intended. You will be notified of issues as we identify them (no surprises). We provide regular status updates on our audit progress (bi-weekly). 15

V. Conclusion and Wrap-up Compile all issues noted during audit. Review results with Director/VC in an Exit Meeting (if needed). Create a draft audit report (1 week response). Publish final report including management responses for any findings. Capture findings and corrective action plans in findings database. Send out Customer Satisfaction Survey. 16

Follow-up on Findings If you have a finding, we will follow up based on the anticipated completion date. Board of Trustees pays particular attention to findings not resolved on time. We start checking in several weeks ahead of planned completion date. 17

What will we request? Your time, cooperation and expertise Documented procedures Supporting documentation Read-only access to software that is unique to your area (i.e. NuPark-PaTS) 18

Questions? 19