1. The Role of the Internal Audit Department

2. Definition of Internal Auditing
“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” The Institute of Internal Auditors
Research Administrators Network

3. Research Administrators Network
We’re Here to Help!
Identify Risks
Find Better Ways and Best Practices
Partner With You to Find Solutions
Prevent Problems
Research Administrators Network

4. We Report to the Board of Regents’ Audit and Compliance Committee
Ensures independence
Elevates issues to a level where they can be corrected
Keeps Regents informed
Meets quarterly
Independence is the foundation of auditing
The Regents can provide resources needed to correct some issues
The President and Regents can adopt policy changes
Research Administrators Network

5. What is Risk Based Auditing?
Focus on risk of occurrences that could prevent the University from achieving its goals
There are many types of risk – fraud, noncompliance, improper reporting, ineffective or inefficient use of resources, reputation loss, etc.
Focus on areas with high risk and high probability that controls are not in place or are weak
Research Administrators Network

6. Research Administrators Network
We have a plan!
Risk based audit plan developed with input from across the University
Risk factors:
Impact
Likelihood
Impact - What would be the impact on the University if this item failed to function? such as a major fraud, or a disruption in business, what would be the impact to the University?
§       High Impact - it could create serious problems for the University that could result in the loss or use of resources, a significant loss of revenues/funding, or unfavorable publicity and possible harm to the University’s reputation
§       Medium Impact – the University would recognize the impact, but would be able to manage the problem
§       Low Impact ·- it would not have a significant impact on the University or its reputation
Likelihood – Considering existing process controls that may exist, what is the probability that this breakdown could occur?
Every area should have certain checks and balances that help prevent things from going wrong, such as review processes, issuing receipts for money received, and approvals (auditors refer to these processes as “controls”). If the controls were not effectively in place, what is the possibility that something could go wrong? Items that might increase the probability include lack of training, complexity or high volumes of transactions, highly regulated areas, high employee turnover, and involvement of management.
§       High Probability – it is very likely that something could go wrong
§       Medium Probability – it is possible that something could go wrong
§       Low Probability – it is not likely that anything will go wrong
Research Administrators Network

7. Research Administrators Network
What Is the Plan?
List of audits for fiscal year
Based on risk assessment and
available man hours
Approved by Audit and
Compliance Committee
Leave some room for the unexpected
Requests and unforeseen issues are presented to Audit and Compliance Committee for approval
Research Administrators Network

8. Research Administrators Network
Auditable Entities
WE DO NOT AUDIT
Specific individuals
Human Resources issues
Sexual harassment or other civil rights issues
WE DO AUDIT
Operations and Compliance
Departments/Schools/ Colleges/Branches
Programs, Grants, Contracts
Information Technology Systems/Applications
University-wide Processes
Research Administrators Network

9. Investigations of Fraud and Impropriety in financial matters
University policy requires Internal Audit to investigate allegations concerning the handling of University financial matters
Internal Audit coordinates and reports to the State Auditor
If we conduct an audit and find inappropriate use of University assets or misappropriation of funds we request an opinion from University Counsel on whether the matter constitutes fraud and if so it is reported to the State Auditor and University Police.
Research Administrators Network

10. Research Administrators Network
Who Are We?
We are University employees
We are certified
public accountants,
internal auditors,
fraud examiners and information system auditors
We are a staff of 7 auditors
Most auditors have more than 10 years audit experience in public accounting, financial auditing, internal audit and performance audit
Research Administrators Network

11. It’s the “little” things that get you!
Misreporting hours
Forgetting to obtain prior approval when needed
Using estimates that are not supported
Any violation of University policy
Employees claimed to be at one place and were not there.
Not reviewing P-card transactions
Not approving purchases prior to placing orders
Unfamiliarity with University policy or misunderstandings
Research Administrators Network

12. Research Administrators Network
Preventive Measures
Make sure your controls are working
Review and reconcile
Check the work of your subordinates
Don’t give in to the temptation to skip controls because you are busy!
It is time consuming to develop proper controls, to review and scrutinize documentation, and to ensure controls are working
However, it is even more time consuming to undergo an audit or investigation
Research Administrators Network

13. What is included in the audit report?
What was found
What was required
Why it happened
What effect it has
Recommendation for improvement
Response – who, when, and how
Audits have six elements
Condition
Criteria
Cause
Effect
Recommendation
Response
Reports have an executive summary with a conclusion answering the objective
Background relating to the area under audit
Observations and Recommendations
Research Administrators Network

14. What happens after the audit?
Follow-up
Review corrective action
Report to Audit and Compliance
Committee
Report to Audit and Compliance Committee, Implemented or Pending
Based on timeframes provided in the response, we conduct a follow-up to verify that corrective action occurred.
Audit and Compliance committee is concerned with past due Pending items and pay close attention to this report
Research Administrators Network

15. Who Audits the Auditors?
We must have a peer review at least once every five years
Our Standards are set by the Institute of Internal Auditors, and the American Institute of Certified Public Accountants
Research Administrators Network

16. We Want to Know How We Are Doing
At the completion of each audit we will send an after-audit survey
We want you to rate our performance
Were we professional, helpful, timely and did we add value?
Please take the time to give us your feedback.
This is one of our measures to determine if our work is adding value to the University
Research Administrators Network

17. Research Administrators Network
We are here to help
We provide training
Respond to Internal Audit policy
Offer suggestions for improvement
Advisory role
PI training
Cash Management
Grants Management
Will conduct consulting services to prevent problems or discontinue inappropriate processes
Research Administrators Network

18. Manu Patel Director of Internal Audit
1801 Roma NE