Resources

Leveraging Technology and AI Tools in Internal Audit: Enhancing Efficiency and Effectiveness

As colleges and universities continue to experience a changing operating environment and the world experiences political and economic challenges, higher education institutions are looking for ways to gain efficiencies within their processes and procedures. At the same time, in the past year, the world has been introduced to astounding technological advancements with the public launch of ChatGPT and availability and improvement of similar Generative Pre-Trained (GPT) Transformers.

As institutions are identifying ways to leverage technology in many areas of operations, Internal Audit also has the opportunity to enhance the efficiency and effectiveness of its work. The use of technology and data analytics have transformed the internal audit function by enabling data-driven insights into new and emerging risks, productivity gains with the automation of labor-intensive audit tasks, increased risk coverage, and repeatable processes for continuous risk monitoring.

The Evolution of Internal Audit

Internal audit functions play a crucial role in ensuring the integrity, compliance, and effectiveness of an organization’s operations. However, Internal Audit is no longer tasked with simply performing evaluations and assessing the effectiveness of risk management, control, and governance processes. Internal auditors are now being tasked with playing a more active role in guiding executive decision-making, leveraging data to identify anomalies and vulnerabilities as well as identifying opportunities to optimize operations across the organization. Further, the nature of risks or activities in which internal audit engagements have become more dynamic and complex.

With the rapid advancements in technology and the rise of artificial intelligence (AI), internal auditors now have powerful tools at their disposal to enhance their work. Today’s technology and digital tools can be utilized throughout the internal audit lifecycle: from information gathering and goal setting, development of risk assessments and audit plans, assessments of plans, performing audits, and reporting results. Automated workflows and data visualizations have improved the process to be more cost-effective and collaborative to allow for more informed decisions.

Leveraging Technology for Internal Audit Effectiveness and Efficiency

When fully integrated, technology tools can be embedded into all elements of the audit lifecycle providing valuable efficiencies and risk insights in the areas below:

Planning & Scoping

Auditors can use technology tools to provide a deeper view of risk when conducting annual audit planning or in scoping each individual audit:

  • Enterprise Risk Assessment and Audit Plan Creation: AI and GPT tools can be used to brainstorm risk areas or industry challenges or assist in creating questions to ask in risk assessment surveys or interviews. Data analytics can be leveraged to help institutions quickly gain insights into enterprise risks and controls, and to prioritize management’s actions by analyzing historical risk factors or identifying areas of lesser controls or ineffectiveness. Technology tools can also be leveraged to provide data visualization of key performance indicators (KPIs) that more readily identify outliers or target areas of greater performance challenges.
  • Audit Planning: Like the items noted above, technology tools can be leveraged for planning specific audits as well. Providing deeper insight into transactional information to better understand key operational activities and risks involved in the audit area allows auditors to prioritize and focus efforts. Further, GPT-style tools can help auditors to develop draft audit plans and identify work steps.

Fieldwork

Technology tools can deeply enhance and streamline fieldwork activities, primarily through leveraging data analysis. Examples below highlight how analytics can be used across a number of common audit areas to provide greater coverage and visibility, with the potential to leverage such actions either for building continuous monitoring programs or for completing distinct audits within the plan.

  • General Ledger Close and Financial Reporting: Analysis of journal entry data can assist institutions in quickly identifying unusual and unauthorized journal entries, automate completeness tests, and prioritize reviews based on risks.
  • Payroll: Payroll data can be visualized to obtain a high-level overview of payroll activity by employee, level, and location including deductions, pay rates, and overtime payments. Testing can be automated to identify payments made before hire date or after termination, excessive overtime per pay period and off-cycle payments.
  • Travel and Entertainment Expense Process: Analytics on travel and expense data can help institutions perform a more targeted and automated review of employee expenses by reviewing data by employee, period, and expense type. Search functions and drill down capabilities can help identify excessive spending, inaccurate or duplicate submissions, and non-compliance with company policy. Results can also be used to select a more targeted sample for detailed testing.
  • Vendor Master Management: An analytic of vendor master data can provide insights into top vendors, inactive vendors, and vendor data integrity. Predetermined tests can identify vendors with missing, inaccurate, or duplicate data which may lead to an inefficient business process or potential fraudulent business activity. 
  • Accounts Payable Process: Data analytics enables institutions to quickly identify inaccurate or duplicate payments, invoice processing delays, segregation of duties conflicts, and distribution of invoices processed and paid for a scope period. These results allow management the ability to drill down to root cause and perform timely resolution of risk areas.
  • Research Expenditures: Expenses charged to sponsored research activities can be reviewed to identify cost allowability concerns or provide opportunities for stronger risk identification. Tools can be deployed to evaluate against common standards (such as the Uniform Guidance or institutional policies) as well as built to leverage system data to check against items like an award’s specific budget.
  • System Access: Data analytics can be leveraged to ensure user access to enterprise systems is accurate and adherence to corporate policy is managed correctly during employee terminations and transfers.
  • Fraud Detection: Machine learning algorithms can learn from historical data to detect new and emerging fraud patterns, enabling auditors to stay ahead of fraudsters. By leveraging AI for fraud detection, internal auditors can enhance their ability to identify and investigate potential fraud, ultimately safeguarding the organization’s assets and reputation. 

Reporting

  • Drafting Reports: GPT technology can be used to write first drafts of audit reports or details for specific findings and recommendations.
  • Action & Issues Tracking: Analytics can be leveraged to continuously monitor audit issues and action plans to drive behavioral change with how issues are remediated.
  • Executive Reporting: The use of technology can optimize Board and Audit Committee reporting on the status of the overall internal audit program to guide executive decision making.

The integration of technology and AI tools in Internal Audit has the potential to revolutionize the profession. Advancements in digital technology can empower institutions to conduct detailed self-audits at regular intervals and continuously monitor risk in a timely, cost-effective, and collaborative manner.

However, internal audit functions must carefully consider how and where they deploy technology tools, especially GPT-type assistance. After attending the recent AuditCon in Miami and hearing the Tuesday morning keynote session from Paul Roetzer, it is clear that with great power comes great responsibility. Users of AI and other technology aided audit processes must ensure there is proper governance in place to support the use of such tools. Internal audit functions must consider any risks associated with the use of tools or other policies or restrictions implemented for their organization, and always remember that GPT-style tools are merely another tool in an auditor’s toolkit and not a fully vetted answer. Challenges include relevancy of data (most tools were last trained on comprehensive data sets from 2021) and accuracy and verifiability of the results provided. Additionally, many data analytics technologies or machine learning models require specialized skillsets and knowledge to appropriately design and deploy.

While the rapidly evolving enhancements to technology capabilities present a bevy of opportunities to increase audit efficiency and effectiveness, it must be done in a thoughtful and intentional manner to best elevate your specific audit function.

Basic IT Tests for Departmental Audits

Audits tend to fall into two categories: process and departmental. Process audits focus on a single university process using a highly unique audit program. These often involve many clients and can take a lot of time. Departmental audits focus on a single client. These tend to be shorter engagements with repeatable processes, with the intent of systematically providing similar coverage for all departments. This article focuses on IT tests that can be applied at the departmental level by both IT and non-IT auditors.

Challenges in Creating a Departmental IT Program

The first challenge faced when creating an IT audit program for use in repeatable departmental audits is making assumptions about the computing environment. A typical office has numerous devices including laptops, desktop computers, and potentially tablets. The environment may also involve remote work, capabilities, employee-owned smartphones, one or more printers, workgroup storage, essential applications, a local network, internet access, and a source of technical support.

The next challenge is aligning information security goals to the environment. While our emphasis tends to focus on the disclosure of sensitive information, auditors should also consider the impact of disruptions to the availability of data and the computing environment. Auditors should be willing to look beyond cybersecurity to the physical world. Information on paper can be equally sensitive and unauthorized physical access to computers is undesirable.

Another challenge revolves around defining accountability for the state of the computing environment. Auditors may discover the business unit believes the IT department is responsible while the IT department believes it is the business unit’s responsibility. In reality, the responsibility is shared. The business unit establishes goals, manages day-to-day operations, and delegates technical issues to the IT department. The ultimate responsibility for securely handling sensitive information belongs to the business unit because they control the entire process.

Simplified IT Audit Tests

 What follows is a brief discussion of a number of tests that can be part of an IT audit program for a departmental audit that could be structured in a way to not need an experienced IT auditor.

Computer Inventories – A maxim posed by the Center for Internet Security is “you cannot manage what you don’t know you have.” Conducting an inventory can determine if the client is aware of      their entire computing environment. There can be computers that were never registered with IT and do not receive periodic updates. There can be computers transferred between departments that still show on the original department’s inventory. There can be mothballed computers which still contain sensitive data sitting on shelves or forgotten in closets with weak physical security. By rigorously maintaining an up-to-date inventory, organizations can ensure every component of their computing environment is accounted for and secured.

Review Installed Software – Collaboration with the IT department is crucial to reviewing installed software. Once an accurate inventory of computers is established in systems such as Microsoft Endpoint Configuration Manager (MEMCM) and/or Jamf (for Mac/IoS devices), those systems can provide lists of software installed. You can compare installed versions of operating systems and software packages to what is currently supported by their vendors. You will have to select software packages to monitor. Packages of concern are usually browsers (Chrome, Edge, Firefox, Safari, etc.) and applications used to interact with Internet content, such as Adobe Acrobat and other PDF readers.
You may find there is no existing standard embodied in your University’s policies or in industry best practices. In such cases, auditors must establish their own criteria. For instance, you may wish to accept that 90% of the installed browsers must be either the most current version or a version that was supported within the last 60 days. Achieving 100% compliance is impractical due to inevitable exceptions and the volume of ongoing updates across a sizable computer population.

The best results from this test will be realized over many departmental audits, perhaps combined with a periodic University-wide IT General Controls audit. While a one-time cleanup is beneficial, a sustained and widespread series of audits yields more substantial long-term benefits.

Auditors may find it best to partner with an Information Security Office to interpret the results. It is important for non-IT auditors and client departments to recognize that automation is the key to applying updates at scale. Reliance on manual updates is untenable across large populations of computers due to the sheer volume of patches required.

Review Service Level Agreements and Contracts – Internal agreements and external contracts that apply to computing devices or services can indicate who is responsible for maintenance and how frequently the maintenance should take place. Maintenance is important in eliminating known vulnerabilities. The lack of internal agreements is not necessarily an issue by itself as many internal processes are informal. The lack of a contract with an external source would be unusual.

Websites – Departmental websites present two principal risks: unintentional disclosure of sensitive data and non-compliance with accessibility standards. In both cases, specialized tools are needed to make an assessment because of the volume of pages and documents to be reviewed. A tool like Spirion can crawl through websites looking for unprotected sensitive data.

An audit function can partner with an accessibility office who might have a tool to generate accessibility reports that produce a scorecard to compare to Web Content Accessibility Guidelines (WCAG) and organizational goals. Auditors are likely to need assistance from an accessibility specialist to interpret details of the report. Expect accessibility issues to be persistent, expensive, and dependent on tools and vendors.

Social Media – A department may manage numerous social media accounts across various platforms. Additionally, there may be old or forgotten accounts, which can pose challenges in terms of tracking and management. Sometimes, the credentials for these accounts may be lost, especially if the individual managing the account has left the organization. In such cases, the recovery of account access might require collaboration with the legal department.

To ensure proper use of social media accounts, it is beneficial to conduct regular audits comparing account activity to the standards set by the University’s communications team. This can help identify any discrepancies or areas of non-compliance.

However, departments must also be mindful of privacy and reputation management. Sharing sensitive or inappropriate content can lead to privacy breaches. Additionally, how a departmental account interacts with individuals, such as students, on social media can impact the department’s image. For instance, a departmental account following students and engaging with their personal content could raise concerns and should be approached with caution.

Public Computers – Departments often provide kiosks and public computers to enhance customer convenience. A frequent issue arises when all users share a common account, potentially leaving files, including those with sensitive data, accessible to subsequent users. Additionally, there is the risk of these public computers being used for unintended purposes.
Conducting an audit on public computers need not be a complex task. Simple checks, such as inspecting download folders for sensitive data and testing browser settings to assess access to potentially inappropriate content, can yield valuable insights into the security and proper use of these resources.

Physical Security – The replacement cost of a computer may only be a few thousand dollars, but the value of sensitive data it holds could potentially lead to millions of dollars in damages if compromised. Additionally, the theft or vandalism of computing equipment can result in significant productivity losses due to the unavailability of essential tools.

Enhancing physical security doesn’t necessarily require advanced penetration testing skills. Simple tools such as traveler’s hooks, J-tools, and under-door tools, which can be acquired for around $100, can be used to assess the vulnerability of doors. Furthermore, conducting an after-hours walkthrough can reveal unlocked doors and windows, highlighting areas in need of improved security measures.

It’s also crucial to evaluate the management of physical keys, including maintaining an up-to-date inventory and records of issued keys, to ensure that only authorized individuals have access to secure areas.

Adding basic IT tests into departmental audits creates a repeatable process that increases your IT coverage across campus.

Considering Culture in Audits

An effective control environment is all about culture, ethical values, and appropriate governance structures. This includes attracting and retaining individuals whose values align with those of the organization and holding them accountable for their actions. It is about setting the norms for how members of an organization agree to treat each other, uphold policies, and deliver on the mission and strategy of the organization.
Culture drives behavior and underpins success or failure of any team. In the best of times, it is difficult to create and protect. Building a strong culture is a meticulous task that requires continuous focus and dedication. Within every interaction lies an opportunity to reinforce culture. Strong connections between people create a higher sense of accountability and responsibility. That is precisely why auditors should always consider cultural aspects of an organization in their engagements.

The Ripples of the Pandemic

In higher education, we operate in a world of multi-faceted operations, shared governance, and federated control structures. Even on a good day, it is challenging to bring the relevant parties to the table to lead conversations about internal controls, fraud risks, and policy governance. Add to the mix the historically poorly documented practices (because someone “has been in their role for many years and they know what they’re doing”), turnover brought on by the great resignation, and the inherently complex and ever-changing compliance and operations landscape, and you have a perfect recipe for the heightened risk of unintentional or intentional misapplication of policies and procedures that may lead to financial or reputational damage to our institutions.

While nearly all core university operations are back on campus in full swing, support operations, such as accounting, finance, information technology, and yes, internal audit, have a varied degree of presence. And while we all have grown to appreciate the flexibility, especially when needing to take care of children, elderly parents, or pets, I can’t help but wonder what might auditors be missing by not being in closer physical proximity with our stakeholders. What has been the impact of multiple work modalities on an organization’s ability to keep focused efforts on compliance and maintaining an effective control environment, particularly in a space as complex and distributed as higher education? If culture truly is the single biggest determinant of employee behavior and organizational success, how can it be cultivated, maintained, and shared, with some employees never having set foot on campus? If there isn’t an intentional effort to create that focus, what is the impact on fraud risk?

The cost of fraud extends well beyond the actual loss suffered. It leads to additional time and money invested in investigations, pursuing actions against perpetrators, and remediating control weaknesses. Fraud also causes a decrease in employee confidence and morale, loss of productivity, and the decline in institutional reputation and degree value. The list of fraud victims at institutions is broad: research sponsors, donors, alumni, current and prospective students, faculty, staff, and larger communities.

With the ripples of the pandemic, we went from knowing and conversing with  our office neighbors to working in near isolation. Not many leaders thought of preserving culture as they scrambled to keep core operations on track, getting creative about adapting processes to the new realities. When not actively and intentionally cultivated, culture fades, as do relationships and accountability.

And that is where auditors need to pay attention. Auditing culture is hard, complex, sensitive, politically charged, often subjective, and, let’s be honest, frustrating. But that doesn’t mean we can’t be alert to the associated risks and incorporate them in our engagements.

No Longer Business as Usual

The post-pandemic working modalities have added new risks and opportunities to organizations. With increased turnover, there was a loss of institutional knowledge. With less tenured staff, or less staff period, there was an actual or a perceived lessoning of oversight. As staff were re-thinking their priorities, so were the students. With enrollment numbers fluctuating and the federal and state support weaning, institutions began to experience budgetary pressures. Faculty and staff were taking on additional responsibilities, which, coupled with higher turnover and overall uncertainty, led to burnout. It became a lot easier to rationalize circumventing controls when feeling overworked, underpaid, and doing the job of several people. Along with a lack of feeling connected to the organization, the risk of unnoticed mistakes and fraud increased.

Trust is Not a Control

Trust helps organizations thrive and achieve goals with greater efficiency. It is an imperative ingredient for healthy relationships and operational effectiveness. However, it does not replace strong internal controls that are tailored, documented, and tested. During the pandemic, many core processes were adjusted for the needs of the times. In some cases, those changes created efficiencies that would stand the test of time, while in other cases controls may have been over-simplified, leading to design weaknesses in the post-pandemic space. Now is an excellent opportunity for auditors to help their organizations evaluate which changes have the staying power and which ones need to be reverted or reconsidered to ensure a strong control environment.
Auditors must possess curiosity, critical thinking, and connectedness with the organization and its culture. Audit planning is the ideal time to understand what has changed in the organization in terms of leadership priorities and risks to help create a more relevant scope and objectives for the audit. The audit universe should be reviewed periodically to identify changes that affect culture and help keep the internal audit function stay systematic and organized.

Auditors should not underestimate the power of a relationship with stakeholders. The quality of those relationships should be cultivated over time. Every interaction can be an opportunity to establish trust in the audit process and provide comfort to stakeholders that they will be supported by Internal Audit with utmost professionalism at the time of need. Auditors should remember to listen with intent to the insights the stakeholder may want to share about departmental changes and cultural shifts.

Culture Matters

Incorporating cultural factors into audit work can enrich perspectives on the organizational control environment. Here are just a few examples of questions to consider:  

Tone at the top:

  • Does leadership set realistic performance targets and communicate them consistently and clearly across the organization?
  • How is organizational culture shared with fully remote employees? How is their sense of belonging fostered?
  • Has the institution performed a climate and culture survey after the pandemic? What were the trends and action items?

Employee services processes:

  • Does your institution consider ethics and integrity of candidates in the hiring process?
  • Does your institution’s philosophy on performance management reflect its values and creates an environment of accountability, integrity, and respect?
  • Is success enabled through periodic training and documented performance guidelines and expectations?
  • Are core hiring processes which may have been simplified during the pandemic, being executed with sufficient law and policy compliance? This includes background checks, I-9 reviews, salary change approvals, vacancy postings, etc.

Reporting mechanisms:

  • Are reporting mechanisms, such as a hotline, implemented and effective?
  • What has been the volume trend for the hotline in the past three years? Is there a change in the types or number of allegations reported? Are the allegations being investigated and resolved?

Business processes:

  • Are internal controls designed for new work modalities?
  • Are policies relatable, enforceable, simple, and easy to use?
  • Have cash management controls reverted back to pre-pandemic standards? Cash management controls may have been adapted during the pandemic, with no one in the office to receive checks, make deposits, or allow for sufficient segregation of duties.
  • Have procurement purchasing cards been adequately monitored? Were higher approval thresholds or looser controls adopted to cope with procurement shortages?
  • Are conflict of interest processes robust enough to educate reporters on what should be disclosed and provide the appropriate level of information for review of possible issues? Are the mitigating plans consistently established, monitored, and enforced?

Next Steps

Due to today’s high pace of macro-environmental changes, multiple work modalities, and continued impacts of the pandemic effects, sustained attention to organizational culture remains critical for effective mitigation of financial, ethical, and compliance risk. Internal auditors can play a vital role in educating their organizations about effective internal controls. There is value in reminding business leaders that trust is not a control, and that they play an important role in establishing the right combination of mechanisms, rules, and procedures to ensure the integrity of information, promoting accountability, and preventing fraud.

If there is one thing we learned in the last four years, it is that change is a constant. Internal auditors can support their institutions attain their goals and objectives by periodically re-evaluating the control design for continued appropriateness. Although internal auditors may not be experts in every process they review, they are experts in validating the design and effectiveness of internal controls. Considering cultural nuances when planning and executing internal audit engagements will only amplify their value.

Promising Practices in Evaluating Federally Funded Award Portfolios

The mission of the National Science Foundation (NSF) Office of Inspector General (OIG) is to provide independent oversight of NSF to improve the effectiveness, efficiency, and economy of its programs and operations, and to prevent and detect fraud, waste, and abuse. That mission extends to overseeing the 11,000 grants, cooperative agreements, and contracts that NSF awards annually to more than 2,000 colleges, universities, and other institutions. These awards fund basic and applied research; support science, technology, engineering, and mathematics (STEM) education; and help strengthen the U.S. research enterprise.

We conduct audits and reviews of NSF’s award recipient organizations to ensure they follow applicable federal regulations and NSF terms and conditions, and that costs claimed on NSF awards are allowable, reasonable, allocable, and necessary to complete award objectives. Through this work we’ve had the opportunity to identify areas of elevated risk that are common to managing federal awards, as well as trends and practices that can help enhance stewardship of federal funds.

A Resource for College and University Auditors

We regularly contract with independent public accounting firms to conduct audits of NSF award recipients on our behalf. In 2022, we published a capstone report, Promising Practices for NSF Award Management, which cataloged our contractor’s observations of award recipients’ control weaknesses and strengths over a 3-year period. The report includes the 5 most frequent finding categories we identified, 46 distinct examples of our most common findings, and promising practices we observed to strengthen controls within those areas. We believe this report will provide a strong foundation for any college or university auditor to develop a risk assessment or audit program related to their institution’s federally funded award portfolio.  

Common Finding Categories

The most common audit finding categories at the institutions we audited included:

  • Unallowable expenses ― We identified costs related to unallowable travel, participant support, salary, material/supply, fringe benefit, publication, consultant, and subaward costs charged to NSF awards.
  • Inappropriately applied indirect costs ― Recipients did not always apply indirect costs to the appropriate Modified Total Direct Cost base and did not apply indirect costs at the rates approved within the recipient’s Negotiated Indirect Cost Rate Agreements.
  • Inadequately supported expenses ― Recipients did not always maintain sufficient evidence to support costs claimed in NSF’s Award Cash Management Service, costs billed by internal service providers, and travel, salary, and consultant costs charged to NSF awards were allowable per federal and NSF regulations.
  • Inappropriately allocated expenses ― We identified instances where recipients inappropriately allocated travel, materials and supplies, publication, and student stipend or tuition costs to NSF awards.
  • Non-compliance with policies and procedures ― Recipients did not always comply with, or did not document their compliance with, organization and NSF program-specific policies and procedures.

Promising Practices

The report identified the following promising practices that could help decrease the likelihood of recipient non-compliance with federal and NSF criteria, as well as improve the stewardship of federal funds:

  • Continually monitor and verify the allowability of high-risk expenses. Recipients were less likely to charge unallowable costs to NSF awards if they implemented processes for the continuous monitoring of high-risk expenses, rather than waiting until after the award expired to review the allowability of the expenses.
  • Strengthen controls over applying indirect cost rates. For example, recipients could implement controls to identify when indirect cost rates change between the proposal submission date and the award date and establish guidance identifying the appropriate indirect cost rate for sponsored projects awarded during provisional rate periods.
  • Ensure recipients create and maintain sufficient, appropriate documentation. Recipients with more robust requirements for documentation creation and retention were more likely to maintain sufficient, appropriate documentation to support that expenses charged to NSF awards were reasonable, allocable, and allowable.
  • Document and justify reasonable allocation methodologies. Recipients that require staff to document and justify reasonable allocation methodologies when purchasing goods and services were more likely to maintain sufficient documentation to support that they had allocated sampled expenses to NSF awards consistent with the relative benefits received by those awards.
  • Regularly review and update grant management policies and procedures. Recipients would have benefited from reviewing and updating their grant management practices on a regular basis. Many noted that their policies did not accurately reflect their current procedures, or they were already in the process of updating the cited policies and procedures.

We hope our Promising Practices for NSF Award Management report will serve as a valuable tool as you evaluate your institution’s federally funded award portfolio. If you have questions, please feel free to reach out to us at OIGPublicAffairs@nsf.gov. Our audit reports of NSF funded institutions can be found on our website.

To report research misconduct or other forms of fraud, waste, abuse, or whistleblower reprisal, please contact us by:

  • Web: oig.nsf.gov/contact/hotline
  • Anonymous Hotline: 1.800.428.2189
  • Mail: 2415 Eisenhower Avenue, Alexandria, VA 22314 ATTN: OIG HOTLINE

What’s on Your Audit Plan?

Every Spring, university audit shops must determine what to include on their audit plan for the next fiscal year. The Chief Audit Executive performs a risk assessment, seeks input from senior leadership, reviews strategic plans and industry trends, and analyzes resources to form an effective plan. While every college and university has unique individual risks and goals, common audit themes emerge and change from year to year.

Most Beneficial Audits of FY23

The ACUA Journal polled the membership and asked which engagements were the most impactful from Fiscal Year 2023. Out of the 58 surveys submitted, 33% of the responses said cybersecurity was most critical. Higher education institutions maintain a wide range of sensitive data, including academic records, student financial details and health care information, along with sensitive research and financial information. Colleges and universities continue to be victims of phishing and ransomware attacks. It is not surprising that cybersecurity audits top the list. Information Technology (IT) general controls and user access were other important IT audits.

Audits of human resources was the second highest, at 16% of responses. This is likely due to employment changes due to the pandemic, with some campuses auditing work from home practices. Payroll audits were beneficial at three universities.

Research security was third highest, at 9% of responses. This topic goes hand in hand with general cybersecurity, as research and study subject data is highly sensitive and desirable. Other topics included foreign influence and research administration, operations, and post-award reviews. Grant funding reviews were noted, including HEERF and CARES pandemic funding grants.

Athletics, admissions, and minors on campus were also noted as the most beneficial audits. See the complete list below:

Table showing FY23 most beneficial audits.

Hot Audit Topics for FY24

he ACUA Journal asked for the “hot” audit topics on the FY24 audit plan, and the responses were surprisingly diverse. Of the 62 topics offered, no single topic received more than six votes. This speaks to the wide risk universe present at colleges and universities. The hottest topics were contracted services with third parties and a repeat of cybersecurity, each with 10%. Research compliance, a perennial favorite, was third on the list with four votes.

Admissions is receiving more attention this year, with planned audits of course fees, enrollment, scholarships, student aid, and student fees. Name, image and likeness (NIL) appeared on the athletics topics. Diversity, equity and inclusion (DEI) and environmental, social and governance (ESG) are increasing in importance this year. Three universities are in various stages of auditing Workday software implementation.

Campus safety, including minors on campus and lab safety, are hot topics this year. There is also an interest in auditing student life, with planned audits of study abroad and student mental health. Familiar financial audits like purchasing cards, segregation of duties, and competitive bids round out the list. The complete list of hot audit topics for FY24 are below:

Table listing hot audit topics for FY24.

Common Audit Plan Favorites

In addition to the hot and emerging topics, there is value in considering recurring internal audit projects with sizable risk. Here are some of the most common college and university audit topics by category:

  • Admissions – admissions review
  • Athletics – NCAA compliance
  • Capital Projects – construction and contracts
  • Financial Management – travel and entertainment review, purchasing card review, payroll
  • Human Resources – hiring, retention, terminations and DEI
  • Information Technology – system implementation, IT general controls, access, disaster recovery, data privacy and cybersecurity
  • Operations – college general controls, centers and institutes
  • Research – sponsored award administrative review, foreign influence, conflict of interest, effort reporting
  • Student Life – housing, Greek life

Whether your work plan includes emerging trends, classic engagements, or a combination of both, it should be tailored to your college or university’s risks and strategic plans to ensure internal audit resources address your specific business processes and risk drivers. Even the best audit plan needs to be agile and budget for contingencies.

Share Your Expertise: ACUA Mentorship Program

The ACUA mentorship program is in its 7th year of pairing those new to internal audit, higher education, and/or seeking professional development with experienced ACUA mentors. The program promotes networking, sharing knowledge, and professional growth, and is a no-cost member benefit. There are currently eighteen pairings for this fiscal year. Once a mentee is matched with a mentor, the two usually meet at AuditCon or virtually to start their fiscal year commitment, which often includes monthly or bimonthly meetings.

Patrick McKinney, Director of Internal Audit at The University of Texas, is the new director of the program and is in charge of matching mentee applicants with mentors. Mentees complete a questionnaire that includes key interest areas, such as creating audit plans, audit program management, creating a new audit function, and working with senior management). Mentors also complete an application that lists their strengths, time availability, institution type and size, and information about past experience. The program is currently in need of additional mentors.

“Give it a Shot.”

New mentor Matt Walsh, Audit Director at Texas Tech, wasn’t sure what to expect from the program. He volunteered because he wanted to give back to his profession and get more involved with ACUA. He met his mentee, who was new to internal audit, on a Zoom call. Walsh asked what she wanted to get out of the program, which was to learn more about career progression and the path he had taken. With 10 years of audit experience, mentoring turned out to be second nature for Walsh.

They established monthly meetings to talk about career paths and her projects at a high level, staying away from specific advice and project details that could affect confidentiality. While a mentor can share ideas on projects, it is encouraged to guide mentees to their supervisors for specific implementation advice.

It is also important to steer a mentee away from complaining about their job and keep the conversation positive. A good mentor can turn the conversation around and ask what the mentee can do to improve the situation. Walsh never experienced complaining and said they had productive conversations with each meeting.

Walsh’s mentee left internal audit during the program, but he is eager to work with a new mentee in the next year. “Mentors don’t have to have experience mentoring,” Walsh said, “they just need job experience. Find out what the mentee needs and go from there.” For those considering becoming a mentor, Walsh says, “Give it a shot. It’s a great way to give back to the profession without a huge time commitment, and a good way to network.”

From Mentee to Mentor

Andre’ McMillan, Associate Director at the University of Delaware, first learned about the mentorship program through the ACUA president who paired him up with a former ACUA member from the University of Alaska. A staff member at the time, McMillan wanted input on career coaching and to better understand the industry. His mentor shared her higher education experiences with him and gave him a better understanding of what his boss was looking for in a rising leader.

The next year McMillan re-applied for the program with a different goal in mind. He had just been promoted to Associate Director and wanted to learn more about effective leadership. With his mentor’s guidance, he learned positive ways to coach his staff members, how to train and develop new staff, and learned tips on assigning work and handling promotions and disciplinary situations. Together they set goals which McMillan shared with his director.

For McMillan, the results were immediate. His mentors asked him about his goals and what he wanted to get out of the program, then established a regular meeting schedule to make mentoring a priority. He was also encouraged to reach out to his mentor on an ad hoc basis when needed. He felt comfortable with the one-on-one interaction, noting it was helpful to get an outside opinion on topics that could not easily be discussed with a direct supervisor.

This year McMillan decided to take the next step and become a mentor himself, paired with new internal auditor Brandi Fleck from the University of Oregon. He took his own mentor’s advice and listened to her needs and set up monthly Zoom meetings for their discussions.

Personalized Support

Fleck was encouraged to apply for an ACUA mentor. While Fleck had worked in research compliance for 4 years, she was new in the internal audit department shop of four employees. She was most interested in learning different methods of auditing, getting a variety of perspectives, discovering career paths, and learning ways to get involved with ACUA. Fleck met her mentor McMillan for the first time at the 2022 Audit Con in Las Vegas.

She first wanted to discuss her current audit work with her mentor. While maintaining confidentiality, she would ask McMillan questions about performing everyday work such as developing a work plan and documenting workpapers. McMillan would ask open ended questions like what is the objective, what is the control, and how can you test the control. She asked for McMillan’s opinion on how to sample non-salary payments between different departments, and McMillan shared some ideas with her. Having a mentor is not a substitute for your own supervisor, but Fleck said it helped to gain a different perspective and bring back ideas to her own department.

McMillan also shared his experiences with professional development. Fleck learned tips on how to work with difficult clients and how to not take things personally after a difficult encounter. McMillan has encouraged her to take the CIA exam and Fleck has started studying for part one.

For those unsure about starting a mentor/mentee relationship, Fleck says to, “Go for it! It’s a great way to connect and develop relationships outside of your university and to get personalized help.”

Expand ACUA Involvement

Another benefit of the program is learning how to become more involved with ACUA. McMillan has been on the Marketing Task Force and the Communications Committee, and even participated on an external quality assessment review (QAR) through ACUA. Fleck has joined the Diversity and Inclusion Committee at ACUA.

All of our mentors and mentees expressed comfort in their relationships and agree there are great people at ACUA who are committed to helping each other and share a responsibility to the profession. While there is a one-year commitment for the mentee/mentor relationship, most pairs continue to keep in touch well after that period, and the benefits can last a lifetime.

The mentorship committee will begin advertising and seeking next year’s mentors and mentees early this summer. Be on the lookout for additional information in your email, Connect ACUA, and the ACUA website. You can also reach out directly to Patrick McKinney at 512-471-0663 or Patrick.mckinney@austin.utexas.edu with any questions you may have.

Reactions to the Proposed IIA Standards Changes

For the past two years the Internal Audit Standards Board (IASB) has been creating the first major update to the Institute of Internal Audit Standards in over 20 years. A draft of the new Standards was released to the public on March 1, 2023. The 90-day public comment phase will commence May 30, 2023. Details about the new Standards changes and a link to the comment survey are on the IIA’s International Professional Practices Framework (IPPF) Evolution website at: https://www.theiia.org/en/Standards/ippf-evolution/

The Current Standards

The existing IPPF consists of multiple documents and resources, often repetitive and difficult to locate. There is a standalone mission of internal audit, “To enhance and protect organizational value by providing risk‐based and objective assurance, advice, and insight.” Mandatory guidance is divided between Core Principles, Definition of Internal Audit, Code of Ethics, and the Standards. The current Standards are further divided between attribute and performance standards. Additional recommended guidance is provided by Implementation Guidance and Supplemental Guidance.

Image mapping current IPPF to new standards.
The existing pieces of the International Professional Practices Framework.

Proposed Changes to the Standards

One of the biggest objectives of the IASB was to consolidate the former fragmented guidance into a single, user-friendly format. The proposed IPPF contains the new Global Internal AuditStandards (“new Standards”) that combines the guidance and is the section that has been released for public comment. The IASB plans to add two additional elements which have not been released yet: Topical Standards, which add more requirements on specific audit topics, and additional guidance on performing engagements.

Image showing proposed IPPF.
The proposed IPPF, with Global Internal Audit Standards released for public comment.



The new Global Internal Audit Standards is a 108-page guide organized into five domains that more clearly indicate key roles and responsibilities. Each domain is broken down into different principles, each with its own requirements, considerations for implementation, and evidence of conformance. At first glance it appears the former guidance has merely been rearranged into a logical format, but the changes are in the details. There is a new purpose, new standards, additional mandatory requirements throughout, changes to quality assurance review (QAR) requirements, additional board oversite requirements, and an increased focus on stakeholders and the public interest. The new domains are as follows:

  • Domain I: Purpose of Internal Auditing – Contains elements of the current Definition and Mission of Internal Audit.
  • Domain II: Ethics and Professionalism – Incorporates and builds upon the current Code of Ethics.
  • Domain III: Governing the Internal Audit Function – Focuses on the relationship between the board and the chief audit executive.
  • Domain IV: Managing the Internal Audit Function – Focuses on the requirements for the chief audit executive to manage the internal audit function effectively
  • Domain V: Performing Internal Audit Services – Focuses on performing assurance and advisory engagements.

ACUA Survey Results

The ACUA Auditing and Accounting Principles sub-committee ecently asked members to complete a brief survey about the proposed changes to the IIA Standards. Surveys were completed by 58 members and gathered overall opinions along with open-ended questions about members’ top pros and cons of the changes.

Overall, 74% of respondents generally supported the proposed new Standards. Members appreciated the improved organization and structure of the domains and having one consolidated source of guidance. They cited the improved clarification of roles and responsibilities, especially regarding the chief audit executive (CAE) and audit committees. There was support over the additional standards and specific guidance within each standard. Some members favored additional emphasis on objectivity and professional skepticism, support for the public sector, and stronger requirements for continuing professional education and external assessors. Members also noted the de-emphasis on having separate Standards for assurance versus consulting engagements.

When asked about their top two concerns over the proposed new Standards, 40% of respondents cited the overly prescriptive requirements throughout the document. The number of “musts” and “shoulds” has members wondering if the internal auditing profession is becoming a big administrative checklist rather than one of critical thinking and professional judgment.

The top concerns over specific sections of the new Standards are as follows:

  • 59% of respondents took issue of the excessive Board requirements throughout Domain III: Governing the Internal Audit Function. Most question whether the IIA has the authority to mandate specific Board requirements as board members are usually not IIA members and the CAE does not have authority over the board’s actions.
  • 41% disagreed with Standard 8.4 External Quality Assurance, which modifies the requirements by mandating an external review be performed every 10 years, instead of a self-assessment with validation, and requires having a Certified Internal Auditor (CIA) on the review team. This is cost-prohibitive and excludes seasoned reviewers who are not CIAs.
  • 21% were concerned with Standard 15.1 Final Engagement Communication because it requires findings to be ranked by significance, as rankings are subjective and cause conflict.
  • 10% disagreed with elements of the new Domain I: Purpose of Internal Auditing. The purpose statement focuses on “enhancing the organization’s success” and “serving the public interest.” The prior mission statement focused on providing a risk-based independent and objective service. Members believe the emphasis on success and serving the public interest presents a conflict of interest and shift in priorities.
  • 10% felt that acknowledgement of bias in Standard 2.1 Individual Objectivity and the statement “Internal auditors must be aware of and manage potential biases” negatively conveys auditors are inherently biased instead of being fair and impartial.

Additional concerns noted as particularly burdensome for the small shops were identified in the following areas:

  • Standard 2.2 Safeguarding Objectivity – Small shops felt the requirement that internal auditors must not provide assurance over an activity where they provided advisory services within the last year is too restrictive and limiting.
  • Standard 10.2 Human Resource Management – “The CAE must establish a program to recruit, develop, and retain qualified internal auditors” may be overly-burdensome.
  • Standard 12.1 Internal Quality Assessment – The suggested alternative for small shops “to consider requesting assistance from others within the organization to conduct periodic assessments, such as former internal auditors or others with suitable knowledge of internal auditing” may not be practical.
  • Standard 12.2 Performance Measurement– A new standard aiming to build upon accountability of internal audit to both the board and senior management requires the CAE to develop and report on a performance measurement methodology creates more administrative work.

Next Steps

While ACUA members are generally in favor of the modifications to the Standards, there are many details that members feel the IIA should reevaluate. The Auditing and Accounting Principles sub-committee have presented the survey results to the ACUA Board in preparation for the ACUA formal response to the IIA. The committee also encourages individual members to complete their own response to the IIA if desired at: https://www.theiia.org/en/Standards/Standards-Public-Comment/

After reviewing the public comments and making any modifications, the IIA anticipates releasing the new Standards in late 2023. The new Standards become effective 12 months from the release date in late 2024.

Letter from the Editor

Hello ACUA Members!

As the flowers bloom and the Class of 2023 graduates, one can’t help but feel the positive change that is occurring all around us, including changes within the Journal and our profession.

I want to thank former Journal editor Gavin Shubert on his work with the ACUA Journal and wish him the best as he leaves higher education to pursue a career in consulting. As the former Deputy Editor, I have graduated to the role as your new Editor, and I’m looking forward to finding a new Deputy Editor and more article contributors. Feel free to reach out to me with questions, comments, or ideas for future articles at editor@ACUA.org

The Journal is making a positive change to share more information about ACUA committees and members to keep you informed and encourage participation. This issue we highlight the ACUA mentorship program, whose FY23 mentees are about to graduate from the program. We also feature member poll results on hot audit topics, remote working, data analytics software, and more in the Tools and Resources section.

Last March in Denver many members graduated from the new auditor track at Audit Interactive, and seasoned auditors expanded their knowledge. Perhaps there are some new mentors and mentees in that group.

Even the IIA Standards are graduating to the new Global Internal Audit Standards. A big thanks to the Auditing and Accounting Principles sub-committee for gathering member concerns for a formal ACUA response. Learn more about the proposed changes in this issue and submit your concerns to the IIA before May 30th. I completed their quick online form already.

As this fiscal year comes to an end, I wish you a happy graduation and a positive start to FY24.

Sincerely,
Kara Hefner

ACUA Poll: Remote Work, Data Analytics and AuditCon

Last month the ACUA Journal launched a poll on ACUA Connect to get input from members on a variety of topics so that trends could be shared with the membership. This article summarizes remote work, data analytics, and AuditCon interest. Information on hot audit topics is shared in a separate article in this issue. There were 64 responses from small, medium, and large shops.

Chart of survey respondents' audit shop size

Remote Work

Since the pandemic, only 27% of respondents are working in the office every day. The number of hybrid workers make up the majority at 51%, while 22% primarily work from home full time.

Pie chart showing primary working arrangements of survey respondents.

For those on a hybrid schedule, 60% come to the office on a set pattern each week. The remainder can be flexible on which days they come in the office, with 22% stating they need to come in for a set number of days.

Pie chart showing hybrid schedules of survey respondents.

Data Analytics Software

Auditors are encouraged to incorporate data analytics into their engagements to identify patterns, detect outliers, test entire populations, identify duplicates, and understand the data better. There were 27 respondents who said they used data analytics software outside of Excel, some using multiple products. The most popular software was nearly evenly distributed between ACL, IDEA, PowerBI, Tableau, and IBM Cognos. Some schools were using TeamMate Analytics, and others used Alteryx and ActiveData plugins.

Pie chart showing data analytics software used by survey respondents.

AuditCon Attendance

This year’s AuditCon will be held in sunny Miami from September 24-28. The ACUA Journal asked the 64 respondents whether they plan to attend. While most were unsure at this time, 15 said yes to in person and 3 plan to attend virtually. We hope to see you there.

Chart showing responses about attending AuditCon in Fall 2023.

Letter from the President

Dear ACUA Colleagues,

I hope everyone is enjoying the beginning of Summer!

It was my pleasure to update the membership at the Annual Business Meeting that occurred on May 23, 2023.  If you were not able to join us, the presentation will be posted to ConnectACUA.  I especially want to take a moment thank our Treasurer, Chris Walker, for his and the Finance and Investment Committee’s work over the past year.

For 2024, the Board engaged a Task Force led by Toni Stephens, to assist in identifying the best path for delivering exceptionally relevant content to our members considering the increased costs of hotels, food and beverage, and hybrid streaming technology post COVID.  After thorough review and discussion of the task force recommendations as well as our financial projections, we are very excited to announce some changes to ACUA’s 2024 conference plans as follows: 

  • 2024 Audit Interactive will occur Virtually  
  • 2024 AuditCon will occur In-Person

After sending out requests for proposals to 9 different cities all over the United States, the Executive Committee reviewed the most economically feasible options for both the Members and the Organization.  I’m excited to share that we are working through final negotiations with a hotel in Atlanta, Georgia for AuditCon 2024.

I look forward to seeing you all in Miami, Florida for AuditCon 2023 September 24-28, 2023 at the Loews Miami Beach Hotel.     

Sincerely,
Melissa Hall, Georgia Institute of Technology
ACUA President