Resources

Athletics Business Office: Emerging Changes and Challenges

Blue Logo for ACUA with the text Journal Articles

By Rachel Flenner, Bret Malone, and Marie Jackson

With recent developments such as Name, Image, and Likeness (NIL) regulations and emerging revenue‑sharing models as a result of the House vs NCAA settlement, many institutions may not fully recognize how significantly these changes impact the Athletics Business Office (ABO). The ABO is now responsible for executing payments to student-athletes arising from revenue-sharing agreements. Also, the ABO must update their NCAA reporting related to new line items related to the House settlement implementation and may need to update or create new structures in existing financial systems to accurately capture these costs. Not only must coaches and student‑athletes stay informed, but ABO staff must also ensure policies, procedures, and internal controls are functioning appropriately to keep pace. This article highlights key areas auditors should consider as they work to support the ABO in a rapidly evolving collegiate athletics environment.

Background

The College Sports Commission (CSC) is the entity created by the “Power” conferences (Atlantic Coast Conference (ACC), Big Ten, Big XII, and Southeastern Conference (SEC)) to oversee the implementation of the House settlement, including mandating the use of two new systems:

  • NIL Go  is the online platform used by student-athletes to report new third-party NIL deals over $600, with reporting expected within 5 days of each executed deal.
  • College Athlete Payment System (CAPS) is for entering revenue-sharing payments made against the annual cap ($20.5 million in FY25-26).

Financial Management

The first area of biggest impact is on the financial stability of athletics’ operations. Key risks to keep in mind regarding financial implications include:

  • Financial instability leads to the elimination or reduction of key services, personnel, and non-revenue generating sports.
  • Inability to sustain maintenance or facility improvements, debt service, or salaries.
  • Use of restricted or unallowable sources of funds to cover revenue-sharing expenses.
  • Failure to adapt and innovate financial modeling needs to consider both cost reduction and revenue maximization.
  • Increased travel and booking costs due to conference realignments.
  • Misalignment with institution leadership regarding how revenue share payments will be allocated among sports.
  • Overcommitment of funds through coaching decisions, contractual guarantees, offered Alston settlement benefits, incremental scholarships, or contingent payments included in agreements.
  • Financial statement misstatement due to improper allocation or reporting of revenue‑sharing funds.
  • Future litigation in the NIL and revenue-sharing space could lead to unexpected financial losses.
  • Inaccurate tracking, which results in financial penalties for exceeding the revenue-sharing cap or incremental scholarship cap.
  • Long-term financial risks related to private equity investment.

Contract Management

Another area to consider involves contract management. Organizations use contracts to obtain different services or products at all levels of athletics. Additionally, contracts are now being used more frequently to guarantee payments to student-athletes, adding a new risk area. ABOs should consult with university counsel to create standard agreement templates to reduce contract risks. In some areas, ABOs may work in collaboration with Athletics Compliance to institute new procedures to mitigate these risks. Some specific risks related to contract management with student-athletes include:

  • Student-athletes and coaches create informal NIL agreements and do not properly document them in an approved contract format.
  • Staffing shortages delay contract processing, approval and or payment, particularly during new enrollment and transfer portal periods.
  • Student-athletes fail to report NIL deals with third parties via the NIL Go Clearinghouse (for fair market value and valid business purpose review).
  • There is no centralized process to ensure revenue-sharing contracts are appropriately tracked and reported to the ABO for financial processing.
  • Standardized revenue sharing agreements are unenforceable or fail to address early departures, ineligibility, buy-outs, or other unique terms.
  • Contract language that creates risks for international student-athletes receiving payments, based on their visa type.
  • Institutional contracts combine NIL and revenue share distributions, creating tracking complexity (only allowable if NIL payment is from the institution not a third party; any guaranteed institutional NIL included in these contracts must also count towards the revenue-sharing cap).
  • Contracts overstate or over-promise funds or commitments to student-athletes that must be paid out regardless of situation (e.g., student-athlete leaving early with large upfront payments already occurring).
  • Inadequate third party contracts for services or software to issue or track payments to student-athletes.
  • Managing potential conflict with pre-existing institutional partnerships and exclusivity clauses.
  • Contracted payment dates to student-athletes that do not consider internal or third-party lead-time needed to establish payment processing (e.g., can you pay the student-athlete on day one of enrollment? This is especially important with portal management).
  • Exposure of sensitive student-athlete data (i.e., banking information, contract terms, etc.).
  • Over reliance or misunderstanding related to third-party tools and reporting (e.g., are roles and responsibilities clearly defined between parties, are data inputs and outputs well understood, and is there monitoring in place to identify issues?).
  • Future compliance issues with Title IX based on revenue-sharing allocations.

ABO Potential Procedures

With so many new and expanded risks, the ABO should consider implementing the following additional controls and procedures:

Roles and Responsibilities

  • Identify the finance and budget lead.
  • Identify revenue share and NIL point personnel.
  • Establish approval authority for revenue contracts (Athletic Director involvement, coach authority, etc.).
  • Verify separation of duties for revenue sharing and NIL (i.e., contract creation, contract approval, disbursement, and reconciliation).
  • Create new processes to initiate and record revenue-sharing agreements by contracted dates.
  • Ensure that new processes incorporate all types of revenue-sharing benefits (e.g., is your institution providing additional benefits such as Alston requirements?).
  • Ensure access to private data (i.e., contract amounts and bank routing information) is limited to applicable employees, and there are privacy safeguards within the software, excel spreadsheets, google docs, etc.

Reconciling and Monitoring

  • Verify gross conference distributions against revenue sharing payments.
  • Ensure agreement between the CAPS system to actual disbursements to contracted amounts ,and document known differences or offsets, in preparation for year-end CSC reporting of revenue-sharing payments.
  • Reconcile revenue share payments in total to per-sport allocations.
  • Identify communication channels to ensure ongoing collaboration and monitoring (likely by Compliance) to ensure payments are made only to eligible student-athletes included on rosters.
  • Monitor cap balances regularly to ensure alignment with institutional allocations.
  • Consider timely communication with stakeholders, and when approaching key thresholds (e.g., 75% of allowable distributions made).
  • Potentially build multi-year forecasts and implications to the budget.
  • Confirm payment distribution method (i.e., direct deposit, monthly, quarterly, tax withholdings, etc.).
  • Verify NIL opportunities exceeding $600 are disclosed, tracked separately from revenue sharing, and are reported through NIL Go.

Training and Communication

  • Train ABO staff and other applicable staff members involved in the NIL and revenue-sharing transactions on NCAA and CSC regulations, as well as applicable institution policies regarding contract management, revenue handling, and disbursement procedures.
  • Train ABO staff and other applicable staff members on the new software that will be used in the NIL and revenue-share process, including privacy (HIPAA/FERPA) and security awareness.
  • Verify staff knowledge aligns with the new tasks, such as financial forecasting and planning.
  • Ensure staff capacities are not being exceeded, leading to gaps in other business office processes.
  • Meet with coaches/administrative staff to ensure all are aligned on the procedures and update them regularly regarding current cap balances and applicable finance situations.
  • Review institutional travel policies and ensure institutional compliance can be maintained with the increase in travel costs due to conference realignments.
  • Document and communicate revenue-sharing allocation methodology to ensure applicable ABO staff members and others (i.e., coaches, ABO, Compliance, institutional leadership, etc.) are aligned and tracked toward agreed amounts.

Internal Audit’s Role

So, you are probably asking yourself, “How can Internal Audit help?” or “I am not an expert on the new requirements, what can I do?” Athletics, despite operating in a very public and rapidly changing environment, can benefit from Internal Audit in a similar way as any other campus unit. For example, Internal Audit can:

  • Evaluate the governance framework in place related to revenue-sharing allocations and strategies.
  • Help evaluate risks and offer an independent and objective assessment of the controls in place to mitigate these risks.
  • Review reconciliation processes for student-athlete payments and assess segregation of duties within revenue‑processing workflows.
  • Evaluate communication and training related to NCAA bylaw and CSC rules requirements for NIL licensing and revenue-sharing.
  • Conduct advisory engagements on new or evolving processes.
  • Ensure process changes still align with institution policy.

While this is just sample of considerations for the ABO, oversight by other offices is also important (i.e., Athletic Compliance, Office of the General Counsel, Tax Office, etc.) Feel free to share this article with your contacts in the ABO. Even sharing best practices and relevant articles with your ABO can provide value. It is more important than ever that the ABO knows where every dollar is going, why it is going there, and whether it aligns with applicable policies and procedures. As Athletics continues to evolve rapidly, auditors play a critical role in ensuring transparency, strong internal controls, and responsible stewardship of university resources.

Methodology Madness: New Standards Guidance for Formalizing Audit Processes

Blue Logo for ACUA with the text Journal Articles

By Kara Hefner

It has been one year since the implementation of the Institute of Internal Auditors’ (IIA) new Global Internal Audit Standards (Standards). Everyone can agree the Standards have become more prescriptive, with more “musts” and “shoulds” than in prior guidance. Another term has come to the forefront: the word “methodology” is found 109 times throughout the 120-page document. There are 13 standards that require documented methodologies, and 17 more that recommend either implementing methodologies or having documented methodologies to provide evidence of conformance.

Gone are the days of simply relying on professional judgment, winging it, and relying on passing the smell test. This article outlines the required and recommended methodologies to aid in consistently application of audit processes.

What are Methodologies?

The term “methodologies” is defined in the Standards’ glossary as “policies, processes, and procedures established by the chief audit executive to guide the internal audit function and enhance its effectiveness.”

As described in Standard 9.3 on Methodology, the chief audit executive must establish methodologies to guide the internal audit function in a systematic and disciplined manner to implement the internal audit strategy, develop the internal audit plan, and conform with the Standards. These methodologies must be evaluated and updated as necessary to improve the internal audit function and respond to significant changes that affect the function. Internal auditors should be trained in the methodologies to ensure consistency within the department.

Documented methodologies are often found in the department’s formal procedure manual, audit charter, and board charter. Some methodologies can be built into workpaper templates, and ratings methodologies are sometimes included for transparency in the final audit reports. It is important that all auditors are familiar with the department’s methodologies, and that reviewers ensure methodologies are consistently applied.

Required Methodologies

Excluding the Methodology standard 9.3 discussed above, the following 12 standards require methodologies to be in place:

StandardMethodology Requirement (abbreviated)
2.2  Safeguarding ObjectivityThe chief audit executive must establish methodologies to address impairments to objectivity. Internal auditors must discuss impairments and take appropriate actions according to relevant methodologies.
4.1 Conformance with the Global Internal Audit StandardsThe internal audit function’s methodologies must be established, documented, and maintained in alignment with the Standards.
11.2 Effective CommunicationThe chief audit executive must establish and implement methodologies to promote accurate, objective, clear, concise, constructive, complete, and timely internal audit communications.
12.1 Internal Quality AssessmentThe chief audit executive must establish a methodology for internal assessments, as described in Standard 8.3 Quality, that includes ongoing monitoring, periodic self-assessments, and communication with the board and senior management about the results of internal assessments.
12.2 Performance MeasurementThe chief audit executive must develop a performance measurement methodology to assess progress toward achieving the function’s objectives and to promote the continuous improvement of the internal audit function.
12.3 Oversee and Improve Engagement PerformanceThe chief audit executive must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies. To assure quality, the chief audit executive must verify whether engagements are performed in conformance with the Standards and the internal audit function’s methodologies. The chief audit executive must ensure that evidence of supervision is documented and retained, according to the internal audit function’s established methodologies.
13.1 Engagement CommunicationAt the end of an engagement, if internal auditors and management do not agree on the engagement results, internal auditors must follow an established methodology to allow both parties to express their positions regarding the content of the final engagement communication and the reasons for any differences of opinion regarding the engagement results.
13.3 Engagement Objectives and ScopeIf a resolution on scope limitations cannot be achieved with management, the chief audit executive must elevate the scope limitation issue to the board according to an established methodology.
13.6 Work ProgramThe engagement work program must identify methodologies, including the analytical procedures to be used, and tools to perform the tasks.
14.3 Evaluation of FindingsInternal auditors must determine whether to report identified risks as findings, based on the circumstances and established methodologies. Internal auditors must prioritize each engagement finding based on its significance, using methodologies established by the chief audit executive.
14.4 Recommendations and Action PlansIf internal auditors and management disagree about the engagement recommendations and/ or action plans, internal auditors must follow an established methodology to allow both parties to express their positions and rationale and to determine a resolution.
15.2 Confirming the Implementation of Recommendations or Action PlansInternal auditors must confirm that management has implemented their action plans following an established methodology, which includes inquiring about progress, performing follow-up assessments, and updating tracking systems.

Recommended Methodologies

The Standards also recommend implementing methodologies for other topics under their Considerations for Implementation and Evidence of Conformance categories. These recommendations are summarized below by domain:

  • Domain II: Ethics & Professionalism – Methodologies may be created for addressing ethical issues, disclosing objectivity impairments, and handling illegal or discreditable behavior by internal auditors. Methodologies can specify actions internal auditors are expected to take in response to legal or regulatory violations of which they become aware. Memorialize the manner in which internal audit staff are properly supervised and the permissible ways auditors may  access information. (Standards 1.2, 1.3, 2.3, and 5.2)
  • Domain III: Governance – Consider documenting methodologies to be followed when an organizational impairment is suspected or identified. Formally document the board’s expectations. The external quality assessment should include a comprehensive review of methodologies and their adequacy. (Standards 7.1, 8.1, and 8.4)
  • Domain IV – Managing – Methodologies are recommended for creating and reviewing the internal audit strategy, creation of the annual audit plan, communicating with the board and senior management, handling of errors and omissions, and evaluating external providers of assurance and advisory services. To develop and retain internal auditors, have a methodology for staff training, project supervision, evaluating performance, improving competencies, and promoting professional development. Develop methodologies for communicating the acceptance of risks with collaboration from the board. (Standards 9.2, 9.4, 9.5, 10.2, 11.1, 11.4, and 11.5)
  • Domain V: Performing – Adopt methodologies for when to perform additional analysis, considering the adequacy of controls, significance, and cost benefit analysis. Implement a rating scale for determining the effectiveness of controls for the final report. For example, develop a scale to identify satisfactory, partially satisfactory, needs improvement, or unsatisfactory. (Standards14.2, 14.5, and 14.6)

Establishing and Improving Methodologies

Now that most internal audit shops have adopted the new Standards, this is a good time to check up on the required and recommended methodologies. Review the Standards against the procedure manual, charters, and workpaper templates and identify any methodologies that should be created or enhanced. Consider formalizing rating scales to aid in ranking findings and conclusions for final reports. Discuss methodology enhancements with your board to ensure alignment.

Once established, perform ongoing monitoring to ensure methodologies are in place and used consistently. Reviewers should verify workpapers follow the established methodology and help coach their team on process deviations. Periodic self-assessments and external assessments can also aid in providing feedback on the effectiveness of your methodologies.

Prioritizing Rest to Become a Better Auditor

Blue Logo for ACUA with the text Journal Articles

By Tyler Morgan

“And from that period on, I was in a wormhole. You couldn’t get me out of the room. I would come home from school, sleep for like 30 minutes, go into a room for four hours, and that was it.” 

The above quote comes from Rick Rubin’s interview of singer/songwriter John Mayer on the former’s Tetragrammaton podcast, and Mayer is describing his teenage years when he was learning how to play guitar. Practicing an instrument for four hours a day will tend to result in one becoming rather proficient. But maybe there was something else contributing to Mayer’s aptitude on the guitar. He does not dwell on it, but embedded subtly in the middle of Mayer’s quote may be a key insight into how he became such a generational talent: he took time to rest.

As it turns out, Mayer is not the only highly successful person to benefit (consciously or unconsciously) from the power of rest. There are numerous examples of highly successful people who prioritized rest as a way to achieve peak cognitive performance, including iconic politicians, inventors, business leaders, writers, artists, and musicians. Instead of viewing rest as a waste of time that could otherwise be used to get more things done, these individuals understood that adequate rest was essential to ensure their working time was used effectively and efficiently. While internal auditors are busy people, it is clear from numerous examples of prolific and impactful individuals from outside the auditing world that even the busiest among us can benefit from prioritizing rest.

Perhaps the most likely objection to using rest as a way to become a more effective internal auditor is the belief that internal auditors simply have too much to do to be able to prioritize rest, but history suggests otherwise. Take, for instance, Winston Churchill during World War II. Churchill first served as the British prime minister from 1940-1945, and there clearly was a lot riding on his performance during this time, with each day being filled with a monumental list of items for him to handle. However, Churchill had a longstanding habit of taking an afternoon nap, and he deemed the fate of the free world resting on his shoulders as no excuse for missing his afternoon slumber. The naps continued during the war. He did not consider napping to be a luxury but rather viewed an afternoon nap as an essential way to maintain his legendary daily productivity. Churchill wrote, “Nature had not intended mankind to work from eight in the morning until midnight without the refreshment of blessed oblivion which, even if it only lasts 20 minutes, is sufficient to renew all the vital forces.” Naps were not a decadent activity to be enjoyed solely when little was going on, but they instead functioned as a way for Churchill to stay in tune with immutable biological rhythms and maintain peak cognitive performance during a historical period when every decision was critical. 

Since internal auditors are knowledge workers, they tend to be judged on the quality of their work rather than quantity. And since work quality is positively correlated with cognitive performance, and cognitive performance is enhanced with adequate rest, it follows that rest is a lever internal auditors can pull to increase the quality of their work. University stakeholders likely will not be impressed that an internal auditor regularly works 60-hour weeks or that they never take breaks during the workday. Instead, internal auditors will be judged on the quality of their output and how beneficial it is to their university, especially as artificial intelligence and other technological innovations likely will reduce the amount of time needed to be spent on mundane, low-value administrative tasks. Instead of focusing on work quantity, internal auditors should prioritize producing high-quality, meaningful output that goes far beyond cookie-cutter reports and trite recommendations. In a world where ChatGPT can quickly spew elegant, professional-sounding reports with all the right buzzwords but little substance or original insight, internal auditors who are able to think critically and apply their institutional knowledge to solve tough problems will increasingly stand out from the crowd and be extremely valuable to university stakeholders.

There is strong evidence that prioritizing rest will enhance internal auditors’ critical thinking skills and problem-solving abilities. While a nap to break up the workday may not be a realistic possibility for many, the good news is that rest is not just limited to naps. There are lots of ways to rest, and the remaining paragraphs will explore a few tips, tricks, and key insights backed by science to help you get the rest you need. 

Walk

It may seem counterintuitive to list exercise as a way to rest, but there is plenty of evidence supporting the idea that physical exertion can help boost cognitive performance and improve memory. While countless forms of exercise may achieve these results, many studies have focused on walking in particular. This is great news for higher education internal auditors, as college campuses are often some of the loveliest places to take a walk. A campus walk can also be a great way to become more informed about what is going on at your university, whether by walking through unfamiliar buildings or by having informal conversations with faculty and staff you encounter. Walking outside also provides the added bonus of getting sunlight, which has been linked to better mood regulation and other cognitive benefits. The combination of physical exertion and sunlight exposure may even improve sleep. 

Sleep

Even if workday naps are not a realistic possibility for you, there are many things you can do to at least ensure the quality of your nighttime sleep. In addition to regular exercise, consistently going to bed at the same time each night ensures your sleep is aligned with your circadian rhythm. Limiting screens and other overstimulating devices near bedtime may make it easier to fall asleep, and the same can be said for caffeine consumption. Even if you can fall asleep a few hours after drinking coffee, there is strong evidence that your sleep quality will suffer even if you are unable to perceive it. This is because caffeine typically takes a long time to break down in the body. In his book Why We Sleep: The New Science of Sleep and Dreams, Matthew Walker points out that caffeine has an average half-life of five to seven hours. This means that half of the caffeine you consumed six hours ago may still be circulating in your system, though this amount could be higher or lower depending on your individual caffeine metabolism. Many of us would never drink six ounces of coffee right before bedtime, so it is worthwhile to consider the fact that having twelve ounces of coffee at four o’clock might be functionally equivalent. Therefore, it may be wise to skip that late-afternoon latte.

Play

We live in a golden age for picking up new hobbies. Given the staggering amount of content available on YouTube and similar platforms, it has never been easier to learn to, say, bake a loaf of sourdough, play the drums, or plant that vegetable garden. Maintaining meaningful pursuits outside of work can help reduce the odds of burnout and ensure that your identity is not completely tied up with your occupation. Promisingly, there is evidence that Americans are increasingly prioritizing hobbies and leisure.

Unfortunately, however, the time we spend with others appears to be declining, despite strong evidence that our relationships and a sense of community are correlated positively with numerous quality of life measures. But hobbies do not have to be solitary pursuits, and combining hobbies with socialization and a sense of community likely will augment their restorative effects. One need look no further than America’s current obsession with pickle ball, a sport often played in groups of four. Is it possible that our love of pickle ball has something to do with its ability to bring us together? If you are not into pickle ball, there are plenty of other activities that you can enjoy with others, such as book clubs, board game nights, running and walking clubs, bowling leagues, volunteering for a nonprofit, and playing in a band.

Leave

According to a 2023 Pew Research Center survey, nearly half of all U.S. workers surveyed who receive paid time off from their employer used less leave than they were offered. While this number might be skewed somewhat by the lack of a distinction between personal and sick leave, it is clear that at least some of the unused leave stems from workers being concerned about their work performance, with 49% of those with unused leave citing a fear of falling behind at work as a reason for forfeiting leave. Similarly, about one in five of those surveyed with forfeited leave were concerned about hindering their chances for advancement. However, if we again apply the logic that being a valuable internal auditor relies on peak cognitive performance, and peak cognitive performance demands adequate rest and a lack of burnout, then it does not follow that forfeiting our vacation time will necessarily make us better internal auditors, and it could be doing the opposite.

Whatever You Do, Do Not Unrest

While engaging in fulfilling and restorative rest pursuits is important, it may be even more important to actively avoid activities that keep your brain stimulated at all times. This is because there is strong evidence that our brains perform important functions when they are not busy dealing with a demanding task or trying to find a solution to a pesky problem. This brain state—characterized by introspection during times when an individual is not deeply concentrating on their external environment—is known as the default mode network (DMN), and the DMN likely assists with problem solving and planning for the future.

The DMN was discovered essentially by accident. Scientists researching which areas of the brain were activated during cognitively demanding tasks noticed that these “active” areas of the brain became deactivated in between tasks, as expected, but something else happened during these rest periods that caught them by surprise. Instead of seeing a brain with minimal activity, they noticed that other areas of the brain began to light up, indicating that though participants might have been at rest, their brains were not. This paved the way for a critical insight: just because we may be taking a mental break, our brains continue furiously working away in the background on our behalf.  As we learn more about the DMN—it was only discovered in 2001—it is appearing increasingly likely that our modern digital environments, saturated with numerous distractions that keep us in a state of perpetual stimulation, are holding the DMN back from performing its important functions. Whether it is out of an attempt to maximize productivity, or just to ward off boredom, we rarely allow our brains a moment to rest. Instead, the moments of time that used to be the domain of boredom are now filled with social media scrolling, listening to podcasts, and replying to texts and e-mails. At the time the DMN was discovered, this level of constant mental stimulation would have been almost impossible, but in just a couple of decades we have transformed into individuals who almost never have to be alone with our own thoughts. This should alarm us since it is clear our brains are doing something important during times of mental rest. Therefore, purposefully abstaining from mentally stimulating activities for at least some time each day may be worthwhile. It may seem like you are wasting time, but in reality you are taking a positive step to ensure that your brain can perform at its best, and hopefully you will quickly notice the benefits of a little rest. 

Strengthening Compliance: Building Alliances Between Internal Audit & Research Administration Through Collaboration

Blue Logo for ACUA with the text Journal Articles

By Monika Cami, Jackie Kimmel, and Jennifer Vitale

Editor’s Note: This article is reprinted from NCURA Magazine, 56(5), published by the National Council of University Research Administrations. It is used with permission from the publisher. Consider sharing this article with your research team and learn about common audit findings in research from our ACUA member authors.

Research universities and institutions are governed by strict regulations. Non-compliance can lead to severe monetary penalties, reputational damage, and impacts on funding. Therefore, it is crucial to proactively manage and mitigate risks. In this landscape, where adherence to complex regulations and standards is non-negotiable, the synergy between internal audit and research administration holds the promise of enhancing compliance. By jointly leveraging their expertise, maintaining open communication, and adopting a unified strategy towards risk management, these partnerships not only foster a culture of compliance and accountability, but also contribute to the overall integrity and efficacy of the research enterprise and continuous improvement across the institution.

Both internal audit and research administration share the common goal of compliance and risk mitigation. By working in tandem, they can ensure that their efforts are complementary and more effective. This article offers a few strategies for fostering productive collaboration with internal audit and provides a synopsis of common outcomes and recommendations. While not an all-inclusive list, we hope these insights will be beneficial when conducting self-assessments of your research operations or as you prepare for a future internal audit of research-related processes.

Tips for working with your internal audit team

  • Be Honest and Open: The audit will be more valuable and more efficient if you are (e.g., if you’re asked for a policy/procedure document and you don’t have one, just say you don’t have one, don’t try to create one at the last minute).
  • Share Your Knowledge:  You are the expert in your area; auditors are experts on risks and internal controls; help us understand your environment, what is working well and what are your concerns. Share this with your team as well. Prepare them for the audit and set expectations for transparency.
  • Be Responsive:  The more responsive you are, the faster we can be out of your hair; if you’re busy and can’t get to us for a few days, respond and let us know when to expect a response so we can plan.
  • Assign a Lead:  Assign someone to coordinate and facilitate with the auditors, get status updates from the audit team, and help remove obstacles.
  • Ask Questions:  We want you to be comfortable and work with us; if you’re curious or confused – just ask; we’ll try not to use too much audit jargon, but if we slip – request clarification.
  • Maintain A Positive Attitude:  Be receptive to recommendations; this is an exercise in continuous improvement; it is faster to talk about/work toward fixing something or making it better than it is to be defensive, blame others, explain all the reasons it is the way it is, refuse, etc. Focus on the solutions, not the problem itself.
  • Collaborate:  We may share a recommendation that doesn’t work in your environment – work with us, suggest alternatives – we can often address the same risk in multiple ways; we want to agree on a solution that makes sense for you.
  • Make a Plan:  Agree on how we will share documents/information (Dropbox, shared drive), schedule regular status check-ins, etc.
  • Provide Access:  Facilitate access to space, intranets, data, etc.; help us schedule interviews, tours, and walkthroughs.
  • Prepare for Future Audits:
  • Address the findings/recommendations from your previous audit
  • Pay particular attention to:
  • Good housekeeping of documentation
  • Monitoring and oversight
  • Governance
  • Maintain an Ongoing Relationship:  Reach out when you have questions and be proactive.
  • Provide Evidence: “Show me” is going to be a common phrase. We have to ‘trust but verify’, so help us ‘see’ the internal controls.
  • Don’t Be Afraid: Audits are collaborative, not punitive, processes.

Common Internal Audit Findings: Missing or ineffective controls

Regardless of the industry or type of business, or even the subject matter of an audit, internal audit findings are very often rooted in one of these common problems: 

  1. A lack of written policies and procedures
  2. Having unclear roles and responsibilities
  3. Not enough or ineffective oversight processes

A house made of strong internal controls requires good housekeeping. Policies and procedures (big and small) should be documented and reviewed from time to time. The foundation of any control is having a clear picture of what you do, how you do it, and who is doing it. Writing this all down for all phases and levels of research administration and clearly understanding who is responsible for each part is packed with benefits such as:

  • Faster and smoother onboarding of new employees.
  • Less disruption when key employees leave (either planned or unexpectedly).
  • Less duplication of efforts (or data).
  • Less loss of institutional knowledge from long-term employees who leave (and take their knowledge with them).
  • Greater productivity when everyone shares the same understanding of a process.
  • Better forecasting of the upstream and downstream effects of a proposed process or business change.
  • More effective and efficient oversight activities by knowing where things can go wrong and identifying easier ways to measure/monitor for them.
  • Faster (and more employee-friendly) adaptation to change.
  • Better protection of your data when you know where it lives and who has access to it.
  • Clearer compliance with laws and regulations.

Other common audit findings include: 



Onboarding/Offboarding Processes: Lack of robust onboarding and offboarding activities, unclear roles and responsibilities, inappropriately granting or removing access (physical and system), no documentation.  

Data and Intellectual Property Protections: Inadequate data management practices, including insufficient data security, improper handling of confidential information, and failure to back up research data. Failure to maintain effective application controls, encryption, authentication, backups, intrusion detection, cloud security controls. Insufficient reaction time to intrusions or business disruptions.  

Expense Approval Processes: Lack of expense support, non-compliance with procurement policies, lack of separation of duties, lack of proper approval, unauthorized delegation of approval.  

Grant Sponsor Reporting: Late or incomplete/inaccurate reporting. Lack of documentation around sponsor communications. Failure to disclose inventions to the sponsoring agency or institution as required by the award and institutional policy.  

Financial Monitoring: Lack of expense reconciliations, inadequate budgeting, unjustified budget or cost transfers. Improper cost sharing allocations.

Indirect Cost Calculations: Incorrect indirect cost calculations, lack of support or justification for the calculations.  

Unallowable Direct Charges: Using grant funds for purposes not directly related to the research project, such as unrelated travel or personal purchases. Lack of justification or support for the charges.

Subrecipient Monitoring: Lack of oversight over subawards, inadequate (undocumented) assurance that the subrecipient is compliant with funding terms and conditions.  		Record Retention: Lack of expectation for retention of: proposal, pre-award, and post-award communications; budget and financial records; research data, results, and analysis; laboratory notebooks or research journals; documentation of materials and methods used in research; publication and presentations resulting from the research; intellectual property disclosures or patents; subrecipient monitoring communications and reviews.  

Asset Management: Insufficient equipment or inventory tracking processes. Unauthorized relocation of sponsor-owned equipment. Improperly secured sponsor-owned equipment. Improper disposal.

Management of contracts and other agreements: Lack of timely review, unclear ownership, lack of termination and change notice requirements, missing other components (right to audit, arbitration) required by general counsel.  

Regulatory Compliance: Unidentified or non-compliant export controls: failure to update Technology Control Plans (TCP); failure to report international travel.  

Training: Failure to complete Responsible Conduct of Research (RCR) Training, purchasing and purchasing card training, expense report training. Failure to track training completion and maintain training records.  

Conflict of Interest: Failure to disclose, review, manage, or report financial conflicts of interest that may affect research integrity. Failure by management to monitor the conflict reporting process.  

Confidentiality and Acceptable Use Policies: Failure to execute nondisclosure/confidentiality agreements, materials transfer agreements, data use agreements.    

Conclusion

Whether you are grappling with complex decisions, developing new processes, or simply looking for guidance or comfort that your operations are on the right track, do not hesitate to connect with the internal audit team at your institution. They are there to serve as a resource for you. By reaching out to internal audit, not only will you benefit from independent and professional advice, but you will also be taking proactive steps towards strengthening department operations and research practices.

Through a collaborative approach, we aim to identify opportunities for improvement, enhance risk management, and ensure effective controls are in place. Remember, by involving us early in your planning and decision-making processes, we can help you reduce or mitigate risks before they become issues and support you in achieving your objectives more efficiently and effectively.

Albert Einstein said, “I have no special talents. I am only passionately curious.” The next time you work with an internal auditor, remember they are just passionately curious and will ask many questions. It is through our curiosity and a desire to learn more about your operations that we often uncover opportunities for enhancing the control environment. In essence, consider internal audit as a resourceful ally within the organization. Whenever you are in doubt or in need of a fresh perspective, reach out; let’s work together to bring out the best in our operations and institutions.

Regulation Updates: Third-Party Topical Requirement, GRC Reporting, and 529 Plan Changes

Blue Logo for ACUA with the text Journal Articles

By the ACUA Auditing & Accounting Principles Subcommittee

The ACUA Auditing and Accounting Principles Subcommittee is committed to providing members with emerging information in our field. This article features the recently released IIA Third-Party Topical Requirement, clarification on the new reporting requirements on governance, risk management, and controls, plus modifications to the 529 education savings plan that allows tax savings for professional certification expenses.

Understanding the IIA’s Topical Requirements for Third-Party Relationships

Topical Requirements are a new, mandatory component of the Institute of Internal Auditors’ (IIA) Global Internal Audit Standards. Internal auditors must apply the Topical Requirements for assurance engagements in the following situations:

  • The topic is included in your audit plan as an assurance engagement.
  • The topic is identified during the course of an audit engagement.
  • The topic is requested as a new engagement, even if it was not part of your original audit plan.

What’s New?

The Third-Party Topical requirement was finalized on September 15, 2025, and will become effective September 15, 2026. According to the IIA, a third-party is “an external individual, group, or entity with whom an organization (‘the primary organization’) has a business relationship.” In simpler terms, this means any person, group, or business your institution works with.

Importantly, the requirement does not just apply to your direct third-party relationships. It also covers any subcontracted relationships, even those several layers down, such as fourth-level subcontractors, if your contract allows them. This broad scope ensures that risks are managed throughout your entire supply chain.

What does the Third-Party Topical Requirement involve?

Internal auditors need to assess their institution’s contract management throughout the third-party life cycle, consisting of selecting, contracting, onboarding, monitoring, and offboarding. Internal auditors should consider these stages when assessing the requirements for these three key areas:

  • Governance: Internal auditors must evaluate how their institution decides with whom to contract, how these relationships are managed, and who communicates with third parties and stakeholders. This includes assessing whether the organization has clearly defined roles and responsibilities for managing third-party relationships, and whether established policies and procedures align with regulations and are updated regularly. Auditors should confirm there is a formal approach to contracting third parties and there are protocols for communicating with relevant stakeholders.
  • Risk Management: Internal auditors must review how their institution identifies, assesses, and monitors third-party risks. This begins with examining due diligence procedures for onboarding third parties. There should be ongoing monitoring and corrective action for deviations, and risk assessments should classify and rank third-party risk. Check for escalation and remediation processes in place for unresolved issues, including remediation or termination.
  • Controls: Internal auditors should assess the controls in place to manage and monitor the risks associated with third parties. Review procurement controls for appropriate sourcing and selecting of third parties and ensure there is an appropriate approval process. Determine whether there is centralized contract management and verify contracts contain risk mitigation clauses, performance expectations, compliance obligations, and are reviewed and updated periodically. Review ongoing third-party monitoring and periodic evaluation, and the monitoring of contract renewal dates and offboarding plans.

By understanding and applying these requirements, your institution can better manage third-party risks and strengthen its overall governance.

Download the Third-Party Topical Requirement and a user guide from the IIA at:

https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/

Other topical requirements to be aware of:

Cybersecurity – effective February 5, 2026

Organization Behavior – public comment period ended, pending finalization.

Organizational Resilience – pending public comment.

https://www.theiia.org/en/standards/2024-standards/topical-requirements

New Reporting Requirements for GRC

The new IIA Global Internal Audit Standards, effective January 9, 2025, introduce more structured and rigorous reporting requirements for Governance, Risk Management, and Controls (GRC). They emphasize clarity, consistency, and alignment with stakeholder expectations.

During an engagement, the Internal Audit function must evaluate the governance processes to ensure the organization promotes ethical behavior, accountability, and transparency. Auditors must identify key risks and ensure they are managed effectively, and review the control framework to identify control deficiencies, weaknesses, and failures.

Standard 14.5 Engagement Conclusions requires internal auditors to develop an engagement conclusion that summarizes the results relative to the engagement objectives. In addition, this standard states “assurance engagement conclusions must include the internal auditor’s judgment regarding the effectiveness of the governance, risk management, and control processes of the activity under review, including an acknowledgment of when processes are effective.”

The considerations for implementation of this standard recommend having methodologies for the internal audit function in the form of a rating scale indicating whether reasonable assurance exists regarding the effectiveness of controls. An example is developing criteria for a scale that indicates “satisfactory, partially satisfactory, needs improvement, or unsatisfactory.”

The AAP Committee aggregated the ratings used by the committee members and created the following example of a rating methodology that is applicable to report ratings and GRC ratings:

Example of Report/GRC Ratings

Standard 15.1 Final Engagement Communication states the final communication for assurance engagements must include a “conclusion regarding the effectiveness of the governance, risk management, and control processes of the activity required,” in addition to the continuing requirements of objectives, scope, recommendations, and any action plans. Auditors are encouraged to use their engagement conclusions derived from their methodologies to meet this reporting standard.

529 College Savings Plans Expanded to Cover Professional Certifications

A provision in the One Big Beautiful Bill Act (OBBBA) that was signed into law in July 2025 included changes in 529 education savings plans that may benefit ACUA members. Traditionally 529 plans were reserved for undergraduate and graduate degree programs, but now certain professional certification and credentialing programs are covered as qualifying expenses. This includes several of our most sought-after certifications, including the Certified Internal Auditor (CIA), the Certified Information Systems Auditor (CISA), and the Certified Public Accountant (CPA).

This is a great opportunity to invest in your professional development, especially if your department does not cover or reimburse certification expenses. Eligible expenses can include study materials, exam fees, and even continuing education required to maintain your credential.

See Section 70414 of the OBBBA for more information. As always, everyone’s tax situation is different, so please consult with your tax advisor to confirm eligibility. Check with your financial institution for assistance setting up a 529 plan.

Mitigating Bias in Internal Auditing: Strategies for Enhanced Objectivity

Blue Logo for ACUA with the text Journal Articles

By Amaya Beck

Internal auditors are tasked with evaluating organizational processes to ensure compliance with laws and regulations, as well as identifying areas for improvement. However, like all professionals, they are prone to psychological biases that can influence their judgments and decisions. These biases can lead to inaccurate audit findings, undermine the credibility of the audit process, and ultimately affect organizational decision-making. By implementing mitigation strategies, Internal Auditors can implement mitigation strategies and enhance the credibility of their work and contribute to more effective organizational governance.

Common Biases in Internal Auditing

Several biases are particularly relevant to internal auditors:

  • Confirmation Bias: This involves favoring information that supports preconceived notions while disregarding contradictory evidence. It can lead auditors to overlook critical issues or misinterpret data.
  • Anchoring Bias: Auditors may rely too heavily on initial information, which can skew their assessment of subsequent data.
  • Overconfidence Bias: This occurs when auditors overestimate their knowledge or judgment, potentially leading to missed errors or omissions.
  • Availability Bias: Auditors may give undue weight to readily available information or recent events, rather than considering a broader range of data.

Strategies for Mitigating Bias

1. Structured Decision-Making Tools: Six Thinking Hats Technique

The Six Thinking Hats technique, developed by Edward de Bono, offers a structured approach to decision-making by encouraging diverse perspectives. This method involves assigning different colored hats to represent various thinking styles: White Hat for facts, Black Hat for risks, Green Hat for creativity, Red Hat for emotions, Yellow Hat for benefits, and Blue Hat for process management. Auditors should metaphorically don the different hats and systematically consider multiple viewpoints to reduce the impact of personal biases and ensure more comprehensive evaluations.

2. Peer Reviews and Second Opinions

Engaging in peer reviews or seeking second opinions can help challenge assumptions and identify potential biases. This collaborative approach fosters a culture of critical evaluation and enhances the reliability of audit findings.

3. Training and Awareness Programs

Educating auditors about common biases and their effects is crucial. Training programs should emphasize the importance of recognizing and mitigating biases to promote a culture of objectivity within audit teams.

4. Organizational Independence and Reporting Lines

Ensuring internal auditors report directly to the audit committee or an equivalent body helps maintain independence and reduces the influence of organizational pressures that might lead to biased judgments.

Conclusion

Mitigating bias in internal auditing is essential for maintaining the integrity and credibility of audit processes. By employing structured decision-making techniques, fostering a culture of peer review, and enhancing awareness of cognitive biases, internal auditors can significantly reduce the impact of biases on their work. These strategies not only improve the quality of audit findings but also contribute to more informed organizational decision-making, ultimately enhancing governance and compliance. By adopting these strategies, internal auditors can enhance their role as guardians of organizational integrity and contribute to more effective governance and compliance practices.

⁂

Resources

  1. https://www.linkedin.com/pulse/psychological-biases-how-affect-internal-auditors-isaac-omosa  
  2. https://www.accaglobal.com/content/dam/ACCA_Global/Technical/audit/pi-banishing-bias-prof-scepticism.pdf 
  3. https://internalauditor.theiia.org/en/voices/2024/august/building-a-better-auditor-beating-behavioral-biases/   
  4. https://abmagazine.accaglobal.com/content/abmagazine/global/articles/2022/nov/practice/the-various-biases-in-audit.html 
  5. https://www.learnleansigma.com/guides/six-thinking-hats/
Avoiding Bias in Your Internal Audit Program

Game Plan: Evaluating Athletics Facility Security and Access

Blue Logo for ACUA with the text Journal Articles

By Candice Lewis and Marie Jackson, ACUA Sidelines Committee

Being a college athletics fan means being a part of something bigger than yourself. It’s about finding community and being a part of a shared experience with your fellow fans for those few hours when time stops but the game clock ticks down. It means retracing your steps on campus, reminiscing about years past, and revisiting traditions that you never seem to outgrow.

In this new era of college athletics, schools build on those feelings of nostalgia and use technology and social media to provide all-access passes to our favorite teams. Sports marketing teams share behind-the-scenes looks at the newest facility upgrades. Student-athletes share their workouts, nutrition tips, and “outfit-of-the-day” videos. Coaches speak on podcasts and break down plays. As schools look to partner more with alumni and donors in the new age of Name, Image, and Likeness (NIL), it becomes increasingly important to craft positive fan experiences. But how can schools boost fan engagement and provide innovative experiences while balancing security and access to protect our student-athletes, staff, and facilities?

This article will highlight some best practices for both routine as well as game day security and access. Your internal audit function can help your athletics department assess their approach to evaluating safety and security, including utilizing campus and third-party experts when needed. Remember that a comprehensive security plan will include physical security, operational security, and cyber security. This article will focus on suggested best practices for physical and operational security for on-campus events and hopefully will get you thinking about how to leverage these concepts for off-campus and cyber-related processes and controls

Ongoing Safety and Security

Academic institutions hold the utmost responsibility to provide a safe environment for their students, staff, and fans. The very nature of campuses, which are generally accessible to the community-at-large, creates additional complexities when planning for security and limiting access to restricted spaces. Poor security practices can significantly impact brand reputation and increase the potential for legal liabilities, so thinking about safety measures is a critical exercise for colleges and universities.

On any given day, access management is crucial to ensuring the ongoing security of athletic facilities and the safety of those that use them. An internal audit review of access management could include:

  • Ensure appropriate processes are in place to grant, manage, and terminate access (both physical keys and digital IDs). Evaluate policies and procedures for administering access, and ensure those policies include guests and third parties (e.g., guidelines for accompanying visiting recruits and their families, or temporary access and credentials for vendors, multimedia partners, press, etc.).
  • Determine who manages this access, and whether campus staff provide any support in this area. Athletics should have practices to effectively and timely address employee terminations, vendor terminations, and changes in student status. Communication protocols in place should ensure ongoing collaboration between campus and athletics staff.
  • Athletics facilities staff should develop a risk-based approach to restricting access and should equip entry points with physical or electronic locks. Entry access controls should include consideration of field gates, parking areas, stairwells, locker rooms, practice facilities, utilities, IT, electrical and mechanical spaces, and media and operation centers. Security alarms may also provide an additional layer of protection in these spaces to deter, detect, and notify staff of intrusions.
  • Evaluate the use of emerging technologies such as facial recognition. Many campuses are using biometric authentication to manage both access to facilities, and to admit fans through entry gates. Consider both security merchant contracts and user agreement terms related to data privacy, collection, and use of data.

Schools rely on security and facility staff to promote safe and secure spaces on their campuses. Here are some best practices to consider when evaluating security operations on your campus:

  • Use of initial and routine background checks for security staff. Consider the timing and renewal of these checks for employees, and in what way Athletics utilizes contracted security companies.
  • Obtain and review incident reporting and communication protocols. Evaluate whether Athletics effectively documents, communicates, and trains security staff on how, to whom, and in what timeframe they should report incidents.
  • Consider ongoing threat assessment practices, and coordination with campus leaders and campus police to ensure consistent application of protocols for gathering information and analyzing and assessing potential threats.
  • Video surveillance is a key component of security operations, and athletics should consider using and monitoring camera footage for athletics event management. Schools should have a policy in place governing the use of both cameras and footage which should include viewing, retention, and release guidance.
  • Determine whether trainings and drills are performed for evacuations, lockdowns, active shooter situations, etc. Verify there is an understanding of emergency management roles and responsibilities, and opportunities to identify shortcomings and enhance processes.
  • Consider cybersecurity risks that are unique to athletics. Network or application outages could affect security systems, parking access, concessions sales, scoreboards, electronic banners, spirit wear sales, fan ticketing, and facial recognition. Additionally, Athletics often uses unique vendor applications not used elsewhere in the university. Conducting an application inventory audit could be a great project for your department and could include data classification and storage, and application user access management.

The following athletics venue and facility risks should be considered:

  • Older stadiums and facilities were not designed with modern day safety and security threats in mind. Ongoing assessment of electrical and mechanical systems, screening systems, evacuation plans, accessibility, and other security technologies is a best practice to continually improve the safety and user experience within facilities.
  • Evaluate non-event credentialing processes for venue staff, security, and vehicles to control and restrict access to appropriate areas within the venue. This is a complex exercise with multiple groups needing unique access (e.g., equipment managers, sports medicine trainers, contractors, volunteers, campus recreation, visitors, and sport camp attendees).
  • Consider the “empty state” of venues, facilities, and fields and how Athletics incorporates closing processes, sweeps, and cameras both within the venue and outside (e.g., attached parking and other spaces included in defined security boundaries). For those schools that rent out facilities or premium spaces for non-athletic events, consider how Athletics is securing those spaces after rentals.

Remember to include adjacent spaces as appropriate. These could include practice facilities, mobile or attached operation centers, broadcast and production facilities, school-sponsored tailgates, and museums.

Gameday Preparations

The safety and security of athletic venues becomes even more critical on game day. As your university prepares to host thousands of visiting fans, opposing team players and coaches, and game day staff, it is essential to ensure appropriate controls are in place for a fun and safe game day experience. Whether you are preparing for an audit or assisting with a review, consider the following points. Note that this list is not exhaustive and each game situation is unique and may require modified or additional controls.

Game day preparations begin way before the first tip of the ball, whistle by the referee, or points scored by the home team. Key coordination and pre-game preparation considerations undertaken by Athletics often include:

  • Game day safety and security requires coordinating multiple safety oversight units, agencies, and processes. University departments such as Athletics, Public Safety, Event Services, Emergency Management, and the Police Department must work with local law enforcement agencies, fire departments, emergency medical personnel, and any contracted security.
  • Ensure proper contracts are in place with external agencies where needed.
  • Verify that all key personnel from other agencies use the correct radio channels and communication methods.
  • Train all personnel in the correct university procedures and review game day operation plans and emergency action plans.
  • Hold pre-game safety meetings with key personnel to review game day events and important information.
  • Conduct tabletop exercises to walk through responses to potential game day risks.
  • Establish command centers both on-site and off-site (if feasible). The off-site command centers allow access to resources if the on-site command center goes offline. These centers should have access to all mentioned resources, personnel, security cameras, weather data, and other agency data as needed.

Athletics personnel should conduct a pre-game security sweep to ensure the venue is secure before players, coaches, and fans enter the venue. Key activities include:

  • Ensure all personnel in the venue prior to the game have proper uniforms and credentials visible. The credentialling process should include a secure storage location and ID verification prior to release. A good example of a credentialing control is the numbered photographer vests seen on the sidelines of conference tournament games.
  • Require University employees, vendors, and outside agencies to enter through authorized entrances, keeping other entrances locked or guarded by security personnel.
  • Place security personnel at key locations, such as all unlocked entrances, locker room entrances, and field access locations, to ensure only authorized personnel gain access.
  • If feasible, use a K-9 explosives detection team to sweep the entire venue, team buses, and any vendors and deliveries that enter after the original sweep.

Physical Security

As fans start arriving the excitement starts to build, and the game day experience begins. Athletics personnel should make additional efforts to ensure a safe and secure environment.

Traffic management controls should be coordinated between the university and local authorities so that fans can arrive at the game on time and depart safely. Implement a game day traffic flow with clear traffic patterns, directions, and signage. Consider non- motorized traffic such as foot or bike. There may also be mass transit routes to accommodate shuttle buses from park and ride lots.

Gate security includes ensuring barriers or barricades, such as concrete posts, are strategically placed to prevent motorized traffic from entering restricted areas. Ensure all gates have security present and gates not in use are locked. Once the gates are open to the public, patrons may go through metal detectors and have bag checks performed by trained personnel to ensure unallowable or dangerous items are not brought into the venue. Consider implementing a clear bag policy to enhance and ease the bag check process.

Field/court and locker-room security is necessary to keep coaches and student athletes safe. Consider using a credentialing process for field/court and locker room access that prevents unauthorized individuals from entering the areas. Security personnel should be positioned at all entry points to field/court to prevent unauthorized access and respond to situations as they arise.

Police/Security/EMS personnel should beproperly stationed at key locations throughout the venue to provide safety and assist patrons, act as a crime deterrent, and have access to resources as needed. They should provide on-going game day security sweeps.

Camera coverage is beneficial in key areas such as parking lots, seating areas, and concourses can help ensure a safe and secure game day environment and assist command centers and security personnel.

Post-Game Considerations

After the game ends and fans are exiting the venue, there is still work to be done.

Rowdy fans or court/field celebrations can happen, especially during rivalry games. In the heat of the moment, fans can get overly excited and take actions such as court/field storming, which could put the safety of players, coaches, and fans at risk. To prepare for this, Universities should educate fans on the consequences, such as fines/penalties, of storming the court/field. There should be an emergency plan that includes standard emergency response codes (e.g., code blue), personnel, and action to be taken.

After the game has concluded and everyone has left the venue it is important for key personnel to hold an official post-game debrief to determine what went well and what didn’t. Lessons learned from this debrief should be implemented at future events to enhance the game day experience for everyone.

Conclusion

The ACUA Sidelines Committee hopes this article provides valuable insights into best practices for routine and game day security and access. As you plan future engagements, consider applying these principles to other on-campus events and event planning. Embracing a proactive and collaborative approach to reviewing and updating security and access protocols is a winning strategy!

Letter from the Editor – Spring 2025

Blue Logo for ACUA with the text Journal Articles

Today the ACUA College and University Journal is graduating from an issue-based format to a rolling publication. I have to admit, initially I was a bit resistant. It’s easier to stay the course, and I was concerned about the impact. Would the articles still get noticed? Would members like the change? Will we have enough submissions to keep it rolling?

I soon found my fears were unfounded, thanks to such a great team who helped make this transition. My deputy editor, Tyler Morgan, advocated for rolling articles from the start as he knows people appreciate a quick read. The Communications committee enthusiastically adopted the change, and Bostrom was on board too. A huge thanks goes out to the Communication Committee’s social media expert Jocelyn Edge for enhancing the website, posting articles, and bringing this concept to life.

The extra push for this change came from the Auditing and Accounting Principles subcommittee, who wanted to publish an article about their IIA Standards Roundtable quickly to help our members with their implementations. Our inaugural rolling article contains member tips on adopting the new reporting requirements, updating charters, defining performance metrics, the new strategic planning element, and quality assessments.

New articles will be announced in three ways: 1) on a Connect ACUA post, 2) on ACUA’s social media platforms, and 3) in Bostrom’s bimonthly email newsletters. If you haven’t already selected your preference, you can choose to receive a daily summary of Connect ACUA posts to your email each morning.

The Communications Committee and I are very excited to offer this rolling format. Watch for upcoming articles on research, athletics safety, and mitigating bias coming soon. We would love to help you get published and earn CPE credits for writing – and now you can submit articles anytime. Please reach out to editor@acua.org for more information.in.

Sincerely,

Kara Hefner, Editor

AAP Roundtable on Implementing the New IIA Standards

Blue Logo for ACUA with the text Journal Articles

On February 11, 2025, the ACUA Auditing and Accounting Principles (AAP) Committee hosted a roundtable discussion on implementing the Institute of Internal Auditors (IIA) Global Internal Audit Standards (Standards), which became effective on January 9, 2025. This event drew 35 ACUA members, who were divided into breakout rooms to share their questions and solutions on five topics with significant changes: reporting, governance/charter, performance metrics, strategic planning, and quality assessments. The AAP committee members facilitated the discussion and contributed to the following summary.

Reporting Requirements

The IIA added reporting elements in “Standard 15.1 Final Engagement Communication.” Changes include prioritizing findings, adding an overall summary of governance, risk, and controls, and adding an owner and due date to the management response.

How are departments reporting conformance in their audit reports while working on implementing the new Standards?  The internal audit departments that have already completed a gap analysis or an internal assessment and have modified their practices to agree with the new Standards continue to use the “in conformance” phrase in their reports. Departments that are still adjusting to the new Standards, or will have an external assessment soon, are temporarily omitting that phrase from their reports.

How are you prioritizing your findings? All members said they are consciously prioritizing their findings, but the methodologies varied. Some departments have defined a matrix for categorizing their findings as “high, medium, or low.” These ratings and definitions are sometimes presented in the reports for context. Other departments are relying on professional judgment in prioritizing their findings and are documenting their reasoning in the work papers. Most departments are including the phrase “findings are listed in order of priority” in the final reports.

How are departments concluding on the effectiveness of the governance, risk management, and control processes (GRC) of the activity reviewed? Most participants have not had to address this new requirement yet. Members are planning to give a conclusion on GRC as a whole, rather than addressing the three elements separately. Many plan to describe GRC from a selection of options, such as “needs improvement/adequate/good” or “satisfactory/enhancement required/significant enhancements required/ineffective.” Departments have begun developing criteria to facilitate consistent rankings of these areas.

Naming the individuals responsible for addressing the findings and the planned completion date is a new requirement, but is this a departure from your current practice? Most members said they are used to providing the estimated completion date on the final report but have not necessarily named the responsible party or division. Some departments that formerly only retained this information in the workpapers will now include this information in the management response section of the report. All agreed that providing the role or division responsible, rather than the name of the specific person, is sufficient.

Governance and Charters

“Standard 6.2 Internal Audit Charter” requires the internal audit charter to include the purpose of internal auditing, commitment to adhering to the Standards, a mandate including scope and types of services to be provided, and defines organization position and reporting relationships.

What changes are departments making to their audit charter? Many departments have been comparing their audit charter to the new Standards to determine what, if any, modifications are necessary. A few schools are using this opportunity to develop their initial charter. Minor changes include updating definitions, such as advisory services, and incorporating language from the IIA charter[TM1]  template, available from the IIA website. Another school looked at the “musts” in the Standards and ensured all were met. Other changes include adding required communications, enhancing the Standards on managing the internal audit function in Domain IV, and adding a section on ethics and professionalism.

Has anyone received any pushback or enthusiastic buy-in on their updated charters? Most members said neither, but mostly because people outside of the Internal Audit Department do not really understand the implication of these changes. However, most felt the Board and Audit Committees have been supportive.

How is the chief audit executive (CAE) managing the changes in communication with the board? Many schools have made presentations to their board regarding the changes to the Standards. Some CAEs are creating a document to formalize the discussions that take place between the CAE and the Board or Audit Committee. All agreed it is important to document what is required to be communicated to the Board.

Performance Metrics

“Standard 12.2 Performance Measurement” is new and states the CAE must develop objectives to evaluate the internal audit function’s performance and promote continuous improvement.

Which performance metrics have you found to be the best measurements of success? The most common metrics discussed at the roundtable included:

  • Status of the audit plan
  • Implementation of corrective actions
  • Post-engagement client surveys
  • Engagement time versus administrative time
  • Continuing professional education
  • Results of internal and external assessments
  • Project timeliness, such as completing engagements within time budgets, reports issued within X days of fieldwork, and hotline reports closed within X days.

Which new performance metrics are being considered as a result of this new standard? All schools said they did not make any changes to their existing performance metrics, though some did add existing metrics to their audit manual. Some were considering adding potential metrics about increasing the automation of work and applying data analytics to more projects. One school said their Board wanted a better understanding of the financial savings achieved, though it is difficult to quantify the value of compliance audits and process improvements.

Do you have performance metrics that tie to an individual auditor or manager? Most schools said their goals are related to the entire team. One school said their managers have additional key performance indicators of timely review of reports and a percentage of their team’s engagements completed. Another said they tie annual merit increases to the number of projects completed.

Strategic Planning

“Principle 9 Plan Strategically” focuses on planning strategically, and “Standard 9.2 Internal Audit Strategy” requires the CAE to develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organization and aligns with the expectations of the board, senior management, and other key stakeholders.

Is strategic planning a new area for internal audit departments? If not, what are your plans for meeting this new standard? Some departments already had a strategic plan and were taking the opportunity to revisit their plan. Many smaller departments had not yet implemented a strategic plan and were preparing to do so.

What resources have you found to be most helpful for developing a strategic plan? The roundtable group discussed some webinars they have attended on the subject. Others have found peer input and online searches on organizational goals and strategies to be helpful.

What types of input did you receive when building your strategic plan? Those who have completed their strategic plan used team feedback, client survey responses, management analysis, their internal audit mission and objectives, and audit committee feedback. Completed plans were shared with the Board and senior management.

Internal and External Quality Assessments

Assessments of internal audit departments now fall under different standards. “Standard 8.3 Quality” requires the CAE to develop, implement, and maintain a quality assurance and improvement function. “Standard 12.1 Internal Quality Assessment” covers ongoing monitoring, periodic self-assessments, and communicating results to the board and senior management about adherence with the Standards. “Standard 8.4 External Quality Assessment” requires an external review conducted every 5 years and include at least one Certified Internal Auditor (CIA) on the external review team.

For those who have completed an internal assessment or gap analysis, what resources did you use? All participants said they used the ACUA AAP – IIA Global Standards 2025 – Self-Assessment Tool and found it helpful in evaluating compliance with the new Standards. Members can download this workbook from the ACUA Resource Library after logging in and searching for “self-assessment tool.”

What were the biggest changes found in your gap assessment? Most felt the enhanced reporting and communication with the Board was the biggest change. Smaller changes needed to be addressed by revising audit manuals, audit charters, and strategic plans. The new ethics and professionalism domain and reporting requirements also needed to be incorporated into the audit manual. Roundtable attendees cited the need for training team members on the changes in the Standards to be able to effectively review engagement workpapers.

Which new topics have the most ambiguity for implementation? Small audit shops and those combined with other areas such as risk and compliance expressed difficulties in demonstrating conformance with the Standards due to inherent differences in organizational and operational structures. The group discussed ways to document conflict of interest disclosures and project-level independence. Others felt the requirements in “Domain III Governing the Internal Audit Function” are quite overarching and may be difficult to implement and document.

Who has plans to have an external assessment in 2025? Only one university said they were due for an external assessment in 2025. Others ensured they completed their assessment before the change in the Standards to allow for more time to conform. All acknowledged they will need to have a CIA on their next review team, though some cited this new criterion may be a challenge as there are not many CIAs in their current pool of assessors.

Conclusion

The first AAP roundtable on the new Standards was a big success. The participants appreciated hearing how fellow members are tackling these changes. Members enjoyed the small breakout group format and the ability to share and collaborate with peer universities on these topics. In the post-event survey, the roundtable attendees unanimously found the roundtable to be helpful and would be interested in attending future roundtables related to the Standards. Please watch for future roundtable opportunities hosted by the AAP!

Professional Skepticism

Blue Logo for ACUA with the text Journal Articles

By Priya Sall

Professional skepticism is challenging to develop and apply as an internal auditor. We naturally desire to trust people, especially those we know. Professional skepticism is an audit skill developed over time and constantly refined. Successful auditors are able to strike a balance between trust and skepticism, as being too trusting can lead to inadequate oversight, and being overly skeptical can lead to unnecessary procedures.

Professional skepticism is an attitude that includes a questioning mind and a critical assessment of information. Applying the right level of skepticism can be challenging. Eager auditors might be too skeptical, resulting in extra or unnecessary audit procedures and increased audit costs. Auditors with a low level of skepticism may ignore red flags that justify spending further time and attention. When an auditee has an inadequate control structure, concerning tone at the top, or other red flags, auditors should gauge their skepticism and respond accordingly. Roadblocks or challenges can also tempt auditors to settle for less, as difficulties in obtaining a higher degree of evidence might lead auditors to rationalize that what they have is good enough.

Applying professional skepticism has inherent limitations, such as the impact on audit efficiency. The more skeptical the auditor, the more time the auditor typically takes to complete an audit. When an auditor is overly concerned with completing the audit within a fixed budget or timeline, professional skepticism and audit quality may be negatively impacted. It is important that budgets and deadlines do not unduly hinder the exercise of skepticism, and supervisors should help auditors develop skepticism skills.

The following methods can be used to enhance auditors’ skepticism skills.

  • Develop a questioning mindset – This is an attitude of curiosity and interest, as those who desire to satisfy curiosity naturally tend to exercise higher levels of professional skepticism. A questioning mindset requires professionals to continually ask questions and seek further clarification until they know they have the necessary information.
  • Suspend judgment – Wait until you are sure before reaching a conclusion. Just as you would not go in with the expectation that everything is wrong, do not assume everything is necessarily correct.
  • Assess evidence gathered and reach an independent judgment based on that evidence – Do not get caught up in groupthink. This means maintaining awareness and attempting to overcome judgment traps.
  • Hone self-confidence – Self-confidence describes the ability of a professional to act upon the information obtained. Sometimes, it is easier to follow the tide even when you know something does not feel right in your gut. If it does not feel right, it probably is not, and you need to keep digging until you are satisfied.
  • Use case studies and simulations – Practice applying professional skepticism using past scenarios and simulated audit engagements.
  • Encourage group discussions and brainstorming sessions – Allowing auditors to discuss and challenge each other’s assumptions and judgments fosters a skeptical mindset.
  • Engage in critical thinking exercises – Provide auditors with exercises that require them to analyze and evaluate information critically, and to consider alternative explanations and potential biases.
  • Train on cognitive biases – This involves raising awareness of common cognitive biases influencing judgment and decision-making, plus providing strategies to mitigate their impact.
  • Engage in continuous professional development – Continuous training keeps auditors updated on emerging issues and supports a balanced level of professional skepticism.

Professional skepticism can be learned just as it can be taught. Auditor working practices and supervisor mentorship must support and encourage skepticism. Learning the right questions to ask, verifying the answers, and knowing when to move on requires balance. Achieving a balanced level of professional skepticism at the onset of every audit supports the audit’s value.