ACUA

Advancing Auditing in Higher Education

Home > College and University Auditor Journal > Summer 2020 > Connect Further: Impacts of COVID-19 on Higher Education Audit Shops

Connect Further: Impacts of COVID-19 on Higher Education Audit Shops

May 18, 2020


The COVID-19 pandemic has affected every person, every company, and every industry throughout the world. As we are all facing our own challenges, and adjusting to what we consider the new normal, I recommend you read “ACUA is Community” and “ACUA Mentorship Program.” Interacting with your peers through the ACUA community may provide yourself, and others, a much needed connection to get through these challenging times.

To help us, as auditors, and our institutions get through the changes and consequences of the COVID-19 pandemic, our third “Connect Further” feature is a central resource for topics related to the impact of COVID-19 on internal audit from ACUA’s online discussion forum, Connect ACUA. This article includes feedback from ACUA members on how COVID-19 has affected institutions, their operations, the internal audit function, and how internal audit can continue to provide value.
 
Most, if not all, audit shops experienced a shift in their audit priorities and made changes to their audit plans.

While no two internal audit shops operate the exact same or have identical audit plans, every internal audit department has been affected by the pandemic. As a result, most, if not all, audit shops experienced a shift in their audit priorities and made changes to their audit plans, whether due to special requests from leadership, new and emerging risks, or some audits requiring a physical presence on campus. Depending on your institution and its available resources (e.g., systems access), some ACUA members may be able to continue with audits as planned. Some audits may need to have their procedures revised or the entire audit may need to be put on hold due to the refocused priorities of the auditees and/or requirements of the audit.

Additionally, keep in mind that while fieldwork may be completed for an audit, certain auditees (i.e., individuals and departments significantly affected) may not have the capacity to review draft audit reports and provide feedback or management action plans at the present time. As such, some members have responded that they are trying to be respectful of those needs by allowing the flexibility of finalizing the audit report at a later time. They are also sensitive to the effect downsizing certain departments has on the amount of time the remaining staff have to respond to audit requests.
 
Audit shops should assess which audits can continue as planned and which engagements can be conducted to continue adding value to the institution.

Audit shops should assess which audits can continue as planned and which engagements can be conducted to continue adding value to the institution. This should be done with minimal disruption to sensitive or urgent operations to not disturb the ongoing complex situation. If possible, audits may need to have their procedures slightly modified to allow the audit to be conducted remotely (i.e., desk audits) and be minimally disruptive to auditees. Some members have temporarily delayed current audit plans to conduct audit and advisory engagements in departments that are not directly impacted by the pandemic and have the availability to collaborate with internal audit.

As campus leaders are busy keeping our institutions operational and afloat, members have noted that they are reaching out to campus leadership and communicating their willingness to assist them and the board with any special requests and advisory engagements. These members have mentioned they are providing assistance by conducting research around all the new legislation affecting the higher education environment. Additionally, internal audit can assist institutional leadership by serving on committees and sharing thought leadership regarding the risks their institution is facing.

Audit shops should keep in mind that while internal audit is providing additional assistance, scheduled non-priority communications with campus leadership may need to be postponed, given that campus leadership is juggling numerous responsibilities. This demonstrates to campus leaders that internal audit is flexible and is respectful of their more prominent concerns.

Members have noted the following are some engagements and activities they are conducting outside of their planned audits for institutional leadership without impairing the independence of internal audit:
  • Ensuring compliance with documentation requirements for paid sick leave and expanded leave
  • Reviewing documentation for return of Title IV funds (R2T4) compliance
  • Assessing the institution’s refund policy and related processes (if the institution has received, or plans to receive funding from the government and/or plans to issue refunds [e.g., recreation center, housing]) to students
  • Evaluating key processes that have changed due to COVID-19
  • Participating on a coronavirus task force at the institution to provide the latest news and guidance on the virus
  • Compiling a list of how peer institutions are changing procedures relating to class delivery, residence halls, events, and dining
  • Analyzing and providing feedback for business continuity plans

...Refresh audit plans [by] putting the focus on short-term and immediate need and seeing how internal audit can assist operationally from a risk assurance standpoint, rather than looking longer term.

Another activity many audit departments are performing is evaluating COVID-19 risks that may not have been present during the risk assessment when defining the audit scope for current and future audits. Thought leaders recommend focusing on refreshing audit plans, putting the focus on short-term and immediate need, and seeing how internal audit can assist operationally from a risk assurance standpoint, rather than looking longer term. Some new and emerging, or existing and heightened, risks to consider as part of the new normal include the following:
  • Academics
    • Ability to conduct classes and labs
    • Grade entry, updates, and changes
    • Integrity of online courses
    • Student admissions (remote interviews and application review)
    • Potential for fraud due to increased enrollment pressures
  • Disbursements
    • Checks and wire transfers (submission and disbursement process)
    • Payroll: Process for personal leave requests
    • Payroll: Timecards and overtime verification
  • Financial
    • Processing credits/refunds to students (fees, tuition, housing) and implications for financial aid
    • Handling of cash and timely deposits
    • Use of donor funds according to donor restrictions
    • Tracking of costs related to Families First Coronavirus Response Act (FFCRA) and Coronavirus Aid, Relief, and Economic Security (CARES) Act
  • Information Technology and Security
    • Changes to workflows and automated controls to process new types of payments (e.g., student relief funds)
    • Privacy and security implications for the remote work environment (e.g., Zoom-bombing, adequate security settings, use of personal devices, utilizing anti-virus software, firewalls, protection of data)
    • Changes in privileges (i.e., elevation of access) and monitoring of activity for users with additional privileges
    • Evaluating whether system changes are required to adequately track COVID-19 related expenses
    • Account sharing
  • Physical Security
    • Building access controls
    • Public safety coverage
  • Procurement
    • Corporate card/travel expenses
    • Inventory management (equipment sent home with employees)
    • Vendor set-up and registration
  • Research Compliance
    • Tracking of personal protective equipment (PPE) donations
    • COVID-19 screening process for research patients
  • Other
    • Usage of cleaning and event services

A common concern among audit shops is whether internal controls will be bypassed or eliminated to be able to complete processes in a timely manner. There may be internal controls that are being ignored and not replaced with a compensating control.
 
...Some institutions may not have the ability to perform many [requests] remotely due to various constraints...[but there are] ways they have been able to keep themselves and their audit staff productive at home.

On the other hand, while there seems to be a lot to keep audit shops busy now and in the future with these risks and special requests from management, some institutions may not have the ability to perform many of these remotely due to various constraints. As such, members have mentioned the following as some ways they have been able to keep themselves and their audit staff productive at home:
  • Improving internal department processes
    • Reviewing and updating audit policies and procedures (e.g., procedure manuals, administrative documents, audit templates)
    • Reviewing client satisfaction surveys and making improvements based off feedback
    • Considering opportunities to refine the format of audit reports
  • Identifying opportunities where internal audit can provide assistance to departments to increase efficiencies and/or automate processes, without impairing independence
  • Updating the institution’s audit universe and preparing for audits that can be conducted once campus operations resume
  • Brainstorming how the risk assessment process may be affected (e.g., new risks, updated questions)
  • Completing various personal and professional development goals
  • Creating or refreshing internal audit’s webpage
  • Developing an internal audit brochure or a newsletter for the campus community
  • Preparing for the QAR and/or completing a self-assessment
  • Reviewing policies across the institution and identifying those that could be updated

The College and University Auditor would like to thank all ACUA members who participated for their time and cooperation. If there are any topics you would like to see in future “Connect Further” features, to provide feedback on this feature, or ask any questions please contact Jackie Pascoe at jackie.pascoe@duke.edu.

About the Author

Jackie Pascoe

Jackie is the deputy editor of College and University Auditor and a principal auditor at Duke University. Prior to Duke, Jackie worked at Baker Tilly Virchow Krause (Baker Tilly) for three years in the Risk, Internal Audit...
Read Full Author Bio

Jackie Pascoe

Jackie is the deputy editor of College and University Auditor and a principal auditor at Duke University. Prior to Duke, Jackie worked at Baker Tilly Virchow Krause (Baker Tilly) for three years in the Risk, Internal Audit and Cybersecurity practice. At Baker Tilly, she worked primarily with colleges and universities to provide internal audit and advisory services. Jackie is a Certified Public Accountant (CPA) and can be reached at jackie.pascoe@duke.edu. 

Articles
Connect Further: Impacts of COVID-19 on Higher Education Audit Shops