Presented by Pam Lebold, CPA Director, Not-for-Profit Services

 Implemented in 2007  Auditors can longer default to max control risk ◦ Must gain an understanding of relevant controls ◦ Which controls are important? Those that mitigate risks that may affect the financial statements  Many “canned” programs to assist auditors in this endeavor

 “Obtain a sufficient knowledge of the entity’s risk assessment process to understand how management identifies business risks that may affect the financial statements…and determine how to address those risks”

 Auditor should determine whether: ◦ Management has established practices for the identification of risks affecting the entity. ◦ Management considers the entire organization as well as its extended relationships in its risk assessment process. ◦ Management evaluates and mitigates risk appropriately.

 One more item on your “to-do” list  Benefits – do they outweigh the costs?

 What are your organizational risks?  Things to consider: ◦ Financial risk ◦ Compliance/legal risk ◦ Operational risk ◦ Reputational risk

 Where to start? START WITH YOU!! (who else??)

 Many different approaches  One possible approach: ◦ Consider the “owner” of this process ◦ Determine who else should be involved ◦ Consider who can be involved on an “as needed” basis ◦ Definitely consider involvement of general counsel

 Have each department head identify “what could go wrong” OR  “What keeps you up at night?”

 Summarize information on a template: ◦ Issue(s) ◦ Date presented ◦ Dept/Responsible person ◦ Impact/Severity (high/mod/low) ◦ Probability of Occurrence (high/mod/low) ◦ Mitigation measures implemented (should explain the rating above) ◦ Overall current risk rating

 By creating this template you can see which items are higher risk than others  Other things to consider: ◦ Perceptions (what’s high risk to some may not be high risk to the entire organization) ◦ Cost benefit (could consider adding cost of impact)

 Once you have templates from the appropriate departments, then what do you do? ◦ Depends on who was the “owner” in the first place ◦ Decision needs to be made to rank the items by importance, then assign “homework”

 Templates are useful to keep track of “wins”  If you are the owner, suggest a few early “wins”  Templates are also useful to keep track of who didn’t perform necessary tasks

 Hot spots: ◦ Grants management ◦ IT ◦ Construction ◦ Student affairs/services ◦ And of course, don’t forget finance!