Internal Audits: What We Do

The IAO staff has the responsibility to maintain exemplary ethics, integrity and objectivity in the performance of their duties.

The chief audit officer and staff of the IAO have the responsibility to:

• Develop a flexible annual audit plan based on an appropriate risk-based methodology and submit that plan to the chancellor and audit committee for review and approval as well as periodic updates;
• Implement the approved annual audit plan and incorporate, as appropriate, any special tasks or projects requested by management, the chancellor or the audit committee;
• Consider the scope of work of the external auditors and regulators, as appropriate, for the purpose of providing optimal audit coverage to the university and avoiding redundancies in audit effort;
• Assist and/or conduct the investigation of suspected fraudulent activities within the university in cooperation with the chief of police and/or general counsel, notify the chancellor and the audit committee of the results, and report as required to outside agencies;
• Provide, as appropriate, consulting services to management that add value and promote the best interests of the university;
• Establish a quality assurance program by which the chief audit officer assures the operations of internal auditing activities are acceptable;
• Maintain appropriate professional development to ensure that staff has the skills and abilities to perform audit assignments;
• Evaluate significant new or changing services, systems, processes, operations and control processes, as deemed necessary, coincident with their development, implementation and/or expansion;
• Submit written and timely reports to the chancellor, the audit committee and appropriate members of management at the conclusion of each engagement to acknowledge satisfactory performance or to set forth findings and/or recommendations for correction or improvement;
• Inform the chancellor and audit committee promptly of emerging trends regarding internal controls, risk management, governance and internal auditing;
• Provide a mechanism for whistleblowing, including receiving, resolving and retaining records of complaints regarding accounting, internal controls and auditing matters;
• Submit at least annually a charter to the audit committee for review and approval.

At least annually, the chief audit officer will submit to the Chancellor and the audit committee an internal audit plan for review and approval. The internal audit plan will consist of a work schedule as well as resource requirements for the next fiscal year.

The internal audit plan will be developed based on a biennial risk-based methodology, including any risks or control concerns identified by senior management, the chancellor or the audit committee. Any significant deviation from the approved internal audit plan will be communicated to the chancellor and the audit committee through periodic activity reports.

A written report will be prepared and issued by the chief audit officer following the conclusion of each internal audit engagement and will be distributed as appropriate. Internal audit results will also be communicated to the audit committee.

The internal audit report may include management’s response and corrective action taken or to be taken in regard to the specific findings and recommendations. Management’s response should include a timetable for the anticipated completion of action to be taken and an explanation for any corrective action that will not be implemented.

The IAO will be responsible for appropriate follow-up on engagement findings and recommendations. Any significant findings will be monitored for appropriate and timely resolution.

The chief audit officer will periodically report to senior management and the audit committee on the IAO’s purpose, authority and responsibility, as well as performance relative to its plan. Reporting will also include significant risk exposures and control issues, including fraud risks, governance issues and other matters needed or requested by senior management, the chancellor or the audit committee.

In addition, the chief audit officer will communicate to senior management, the chancellor and the audit committee on the IAO’s quality assurance and improvement program, including results of ongoing internal assessments and of external assessments conducted at least every five years.