1. 1 - 1 Audit Plan Formulation Audit Activity and Results Assess prior audit reviews and findings to determine where additional audit and follow-up activities should occur Identify areas for audit plan inclusion for Federal auditor reliance (e.g. DCAA) University Management Meet with members of management to discuss key concerns surrounding current environment or upcoming initiatives Meet with financial heads within the academic units/schools to discuss areas of key concern and focus Risk Initiatives / ERM Solicit input from individuals overseeing re-launch of Risk Initiatives / ERM Revisit results of prior central-focused ERM initiative (compliance and operational risks only) for relevancy and consider items for inclusion Industry Focus / Subject Matter Expertise Consult with strategic partner, KPMG, on emerging issues within Higher Education for inclusion on the 2016 Plan Validate that proposed 2016 Plan addresses risk elements identified by KPMG External Audit Integrate plan with PricewaterhouseCoopers LLP, the University’s external auditors Confirm plan contains areas of review agreed upon during audit coordination discussions University Leadership Present proposed draft plan to President and his leadership team for their review and feedback

2. 1 - 2 Plan Overview The respective areas for review are generally classified into one of four audit categories: Planned Reviews – Audits identified to address specific results of risk assessment, other important areas from a business operations standpoint, and/or in response to new or changes in regulatory requirements; Advisory Engagements – Areas where IA resources will provide advisory guidance and recommendations at management’s request or for newly developed initiatives currently underway at the university; Cycle Reviews - Routine audits as identified by management and/or the Audit Committee to be performed on a periodic basis; and Annual, Mandatory Audit Support – Audits performed at the request of the Defense Contract Audit Agency (DCAA) and/or in support of the Financial Statement audits.

3. 1 - 3 Plan Overview (continued) In addition to proposed audits, hours will be reserved for: Management requests that emerge during the plan year; and Follow-up testing related to prior findings identified through internal audit activities. The 2016 plan continues focus and investment in areas identified by the Audit Committee: Project cost audits related to the Scott Hall and Tepper capital projects; Real-time assessment of critical/significant IT projects at the university, such as SPARCS and the Workday stabilization; and Reviews surrounding sponsored research and research compliance. Approximately 75% of the 2016 Plan will be staffed by internal resources. The remaining portion will utilize specialist resources from KPMG LLP. Hours does not include University Audit Services’ efforts relating to the continuous audit of the PCard program and Employee Reimbursements.

4. 1 - 4 Proposed 2016 Plan AREA OF REVIEWINTERNAL HRS. EXTERNAL HRS. RESOURCING Cycle Reviews Departmental Reviews - College of Fine Arts350 Internal Audit Departmental Reviews - Tepper School of Business350 Internal Audit Planned Reviews Information Security Review - Phase 2100400IA / SMP Procurement Readiness Assessment - Uniform Guidance35050IA / SMP Real Time Construction Review - Multiple Projects500 IA / SMP SPARCS Implementation - Ongoing Assessment150350IA / SMP Sponsored Projects Accounting / Post Award Administration Review 500Internal Audit Student Accounts Review500 Internal Audit Subrecipient Monitoring within Pre-Award - Uniform Guidance350 Internal Audit Workday Post Go-Live Process Review - Ongoing Support500 Internal Audit Annual, Mandatory Audit Support PwC Direct Assistance - Walkthrough Support600 Internal Audit Retirement Plan Audit Support (2015)200 Internal Audit Advisory Engagements Budget Modeling - University Initiative Support150200IA / SMP Business Intelligence / Institutional Data Capabilities Assessment100300IA / SMP Electronic Content Management System Assessment150250IA / SMP IT Cost/Governance Study - Phase 2200 Internal Audit Software License / Cost Management Analysis50250IA / SMP University Policies600 Internal Audit Management Requests500 Hotline Investigations250 Follow-up Testing250 6,7002,300 TOTAL PLAN HOURS 9,000