Resources

Every Spring, university audit shops must determine what to include on their audit plan for the next fiscal year. The Chief Audit Executive performs a risk assessment, seeks input from senior leadership, reviews strategic plans and industry trends, and analyzes resources to form an effective plan. While every college and university has unique individual risks and goals, common audit themes emerge and change from year to year.

Most Beneficial Audits of FY23

The ACUA Journal polled the membership and asked which engagements were the most impactful from Fiscal Year 2023. Out of the 58 surveys submitted, 33% of the responses said cybersecurity was most critical. Higher education institutions maintain a wide range of sensitive data, including academic records, student financial details and health care information, along with sensitive research and financial information. Colleges and universities continue to be victims of phishing and ransomware attacks. It is not surprising that cybersecurity audits top the list. Information Technology (IT) general controls and user access were other important IT audits.

Audits of human resources was the second highest, at 16% of responses. This is likely due to employment changes due to the pandemic, with some campuses auditing work from home practices. Payroll audits were beneficial at three universities.

Research security was third highest, at 9% of responses. This topic goes hand in hand with general cybersecurity, as research and study subject data is highly sensitive and desirable. Other topics included foreign influence and research administration, operations, and post-award reviews. Grant funding reviews were noted, including HEERF and CARES pandemic funding grants.

Athletics, admissions, and minors on campus were also noted as the most beneficial audits. See the complete list below:

Hot Audit Topics for FY24

he ACUA Journal asked for the “hot” audit topics on the FY24 audit plan, and the responses were surprisingly diverse. Of the 62 topics offered, no single topic received more than six votes. This speaks to the wide risk universe present at colleges and universities. The hottest topics were contracted services with third parties and a repeat of cybersecurity, each with 10%. Research compliance, a perennial favorite, was third on the list with four votes.

Admissions is receiving more attention this year, with planned audits of course fees, enrollment, scholarships, student aid, and student fees. Name, image and likeness (NIL) appeared on the athletics topics. Diversity, equity and inclusion (DEI) and environmental, social and governance (ESG) are increasing in importance this year. Three universities are in various stages of auditing Workday software implementation.

Campus safety, including minors on campus and lab safety, are hot topics this year. There is also an interest in auditing student life, with planned audits of study abroad and student mental health. Familiar financial audits like purchasing cards, segregation of duties, and competitive bids round out the list. The complete list of hot audit topics for FY24 are below:

Common Audit Plan Favorites

In addition to the hot and emerging topics, there is value in considering recurring internal audit projects with sizable risk. Here are some of the most common college and university audit topics by category:

• Admissions – admissions review
• Athletics – NCAA compliance
• Capital Projects – construction and contracts
• Financial Management – travel and entertainment review, purchasing card review, payroll
• Human Resources – hiring, retention, terminations and DEI
• Information Technology – system implementation, IT general controls, access, disaster recovery, data privacy and cybersecurity
• Operations – college general controls, centers and institutes
• Research – sponsored award administrative review, foreign influence, conflict of interest, effort reporting
• Student Life – housing, Greek life

Whether your work plan includes emerging trends, classic engagements, or a combination of both, it should be tailored to your college or university’s risks and strategic plans to ensure internal audit resources address your specific business processes and risk drivers. Even the best audit plan needs to be agile and budget for contingencies.

The ACUA mentorship program is in its 7^th year of pairing those new to internal audit, higher education, and/or seeking professional development with experienced ACUA mentors. The program promotes networking, sharing knowledge, and professional growth, and is a no-cost member benefit. There are currently eighteen pairings for this fiscal year. Once a mentee is matched with a mentor, the two usually meet at AuditCon or virtually to start their fiscal year commitment, which often includes monthly or bimonthly meetings.

Patrick McKinney, Director of Internal Audit at The University of Texas, is the new director of the program and is in charge of matching mentee applicants with mentors. Mentees complete a questionnaire that includes key interest areas, such as creating audit plans, audit program management, creating a new audit function, and working with senior management). Mentors also complete an application that lists their strengths, time availability, institution type and size, and information about past experience. The program is currently in need of additional mentors.

“Give it a Shot.”

New mentor Matt Walsh, Audit Director at Texas Tech, wasn’t sure what to expect from the program. He volunteered because he wanted to give back to his profession and get more involved with ACUA. He met his mentee, who was new to internal audit, on a Zoom call. Walsh asked what she wanted to get out of the program, which was to learn more about career progression and the path he had taken. With 10 years of audit experience, mentoring turned out to be second nature for Walsh.

They established monthly meetings to talk about career paths and her projects at a high level, staying away from specific advice and project details that could affect confidentiality. While a mentor can share ideas on projects, it is encouraged to guide mentees to their supervisors for specific implementation advice.

It is also important to steer a mentee away from complaining about their job and keep the conversation positive. A good mentor can turn the conversation around and ask what the mentee can do to improve the situation. Walsh never experienced complaining and said they had productive conversations with each meeting.

Walsh’s mentee left internal audit during the program, but he is eager to work with a new mentee in the next year. “Mentors don’t have to have experience mentoring,” Walsh said, “they just need job experience. Find out what the mentee needs and go from there.” For those considering becoming a mentor, Walsh says, “Give it a shot. It’s a great way to give back to the profession without a huge time commitment, and a good way to network.”

From Mentee to Mentor

Andre’ McMillan, Associate Director at the University of Delaware, first learned about the mentorship program through the ACUA president who paired him up with a former ACUA member from the University of Alaska. A staff member at the time, McMillan wanted input on career coaching and to better understand the industry. His mentor shared her higher education experiences with him and gave him a better understanding of what his boss was looking for in a rising leader.

The next year McMillan re-applied for the program with a different goal in mind. He had just been promoted to Associate Director and wanted to learn more about effective leadership. With his mentor’s guidance, he learned positive ways to coach his staff members, how to train and develop new staff, and learned tips on assigning work and handling promotions and disciplinary situations. Together they set goals which McMillan shared with his director.

For McMillan, the results were immediate. His mentors asked him about his goals and what he wanted to get out of the program, then established a regular meeting schedule to make mentoring a priority. He was also encouraged to reach out to his mentor on an ad hoc basis when needed. He felt comfortable with the one-on-one interaction, noting it was helpful to get an outside opinion on topics that could not easily be discussed with a direct supervisor.

This year McMillan decided to take the next step and become a mentor himself, paired with new internal auditor Brandi Fleck from the University of Oregon. He took his own mentor’s advice and listened to her needs and set up monthly Zoom meetings for their discussions.

Personalized Support

Fleck was encouraged to apply for an ACUA mentor. While Fleck had worked in research compliance for 4 years, she was new in the internal audit department shop of four employees. She was most interested in learning different methods of auditing, getting a variety of perspectives, discovering career paths, and learning ways to get involved with ACUA. Fleck met her mentor McMillan for the first time at the 2022 Audit Con in Las Vegas.

She first wanted to discuss her current audit work with her mentor. While maintaining confidentiality, she would ask McMillan questions about performing everyday work such as developing a work plan and documenting workpapers. McMillan would ask open ended questions like what is the objective, what is the control, and how can you test the control. She asked for McMillan’s opinion on how to sample non-salary payments between different departments, and McMillan shared some ideas with her. Having a mentor is not a substitute for your own supervisor, but Fleck said it helped to gain a different perspective and bring back ideas to her own department.

McMillan also shared his experiences with professional development. Fleck learned tips on how to work with difficult clients and how to not take things personally after a difficult encounter. McMillan has encouraged her to take the CIA exam and Fleck has started studying for part one.

For those unsure about starting a mentor/mentee relationship, Fleck says to, “Go for it! It’s a great way to connect and develop relationships outside of your university and to get personalized help.”

Expand ACUA Involvement

Another benefit of the program is learning how to become more involved with ACUA. McMillan has been on the Marketing Task Force and the Communications Committee, and even participated on an external quality assessment review (QAR) through ACUA. Fleck has joined the Diversity and Inclusion Committee at ACUA.

All of our mentors and mentees expressed comfort in their relationships and agree there are great people at ACUA who are committed to helping each other and share a responsibility to the profession. While there is a one-year commitment for the mentee/mentor relationship, most pairs continue to keep in touch well after that period, and the benefits can last a lifetime.

The mentorship committee will begin advertising and seeking next year’s mentors and mentees early this summer. Be on the lookout for additional information in your email, Connect ACUA, and the ACUA website. You can also reach out directly to Patrick McKinney at 512-471-0663 or Patrick.mckinney@austin.utexas.edu with any questions you may have.

For the past two years the Internal Audit Standards Board (IASB) has been creating the first major update to the Institute of Internal Audit Standards in over 20 years. A draft of the new Standards was released to the public on March 1, 2023. The 90-day public comment phase will commence May 30, 2023. Details about the new Standards changes and a link to the comment survey are on the IIA’s International Professional Practices Framework (IPPF) Evolution website at: https://www.theiia.org/en/Standards/ippf-evolution/

The Current Standards

The existing IPPF consists of multiple documents and resources, often repetitive and difficult to locate. There is a standalone mission of internal audit, “To enhance and protect organizational value by providing risk‐based and objective assurance, advice, and insight.” Mandatory guidance is divided between Core Principles, Definition of Internal Audit, Code of Ethics, and the Standards. The current Standards are further divided between attribute and performance standards. Additional recommended guidance is provided by Implementation Guidance and Supplemental Guidance.

Proposed Changes to the Standards

One of the biggest objectives of the IASB was to consolidate the former fragmented guidance into a single, user-friendly format. The proposed IPPF contains the new Global Internal AuditStandards (“new Standards”) that combines the guidance and is the section that has been released for public comment. The IASB plans to add two additional elements which have not been released yet: Topical Standards, which add more requirements on specific audit topics, and additional guidance on performing engagements.

The new Global Internal Audit Standards is a 108-page guide organized into five domains that more clearly indicate key roles and responsibilities. Each domain is broken down into different principles, each with its own requirements, considerations for implementation, and evidence of conformance. At first glance it appears the former guidance has merely been rearranged into a logical format, but the changes are in the details. There is a new purpose, new standards, additional mandatory requirements throughout, changes to quality assurance review (QAR) requirements, additional board oversite requirements, and an increased focus on stakeholders and the public interest. The new domains are as follows:

• Domain I: Purpose of Internal Auditing – Contains elements of the current Definition and Mission of Internal Audit.
• Domain II: Ethics and Professionalism – Incorporates and builds upon the current Code of Ethics.
• Domain III: Governing the Internal Audit Function – Focuses on the relationship between the board and the chief audit executive.
• Domain IV: Managing the Internal Audit Function – Focuses on the requirements for the chief audit executive to manage the internal audit function effectively
• Domain V: Performing Internal Audit Services – Focuses on performing assurance and advisory engagements.

ACUA Survey Results

The ACUA Auditing and Accounting Principles sub-committee ecently asked members to complete a brief survey about the proposed changes to the IIA Standards. Surveys were completed by 58 members and gathered overall opinions along with open-ended questions about members’ top pros and cons of the changes.

Overall, 74% of respondents generally supported the proposed new Standards. Members appreciated the improved organization and structure of the domains and having one consolidated source of guidance. They cited the improved clarification of roles and responsibilities, especially regarding the chief audit executive (CAE) and audit committees. There was support over the additional standards and specific guidance within each standard. Some members favored additional emphasis on objectivity and professional skepticism, support for the public sector, and stronger requirements for continuing professional education and external assessors. Members also noted the de-emphasis on having separate Standards for assurance versus consulting engagements.

When asked about their top two concerns over the proposed new Standards, 40% of respondents cited the overly prescriptive requirements throughout the document. The number of “musts” and “shoulds” has members wondering if the internal auditing profession is becoming a big administrative checklist rather than one of critical thinking and professional judgment.

The top concerns over specific sections of the new Standards are as follows:

• 59% of respondents took issue of the excessive Board requirements throughout Domain III: Governing the Internal Audit Function. Most question whether the IIA has the authority to mandate specific Board requirements as board members are usually not IIA members and the CAE does not have authority over the board’s actions.

• 41% disagreed with Standard 8.4 External Quality Assurance, which modifies the requirements by mandating an external review be performed every 10 years, instead of a self-assessment with validation, and requires having a Certified Internal Auditor (CIA) on the review team. This is cost-prohibitive and excludes seasoned reviewers who are not CIAs.

• 21% were concerned with Standard 15.1 Final Engagement Communication because it requires findings to be ranked by significance, as rankings are subjective and cause conflict.

• 10% disagreed with elements of the new Domain I: Purpose of Internal Auditing. The purpose statement focuses on “enhancing the organization’s success” and “serving the public interest.” The prior mission statement focused on providing a risk-based independent and objective service. Members believe the emphasis on success and serving the public interest presents a conflict of interest and shift in priorities.

• 10% felt that acknowledgement of bias in Standard 2.1 Individual Objectivity and the statement “Internal auditors must be aware of and manage potential biases” negatively conveys auditors are inherently biased instead of being fair and impartial.

Additional concerns noted as particularly burdensome for the small shops were identified in the following areas:

• Standard 2.2 Safeguarding Objectivity – Small shops felt the requirement that internal auditors must not provide assurance over an activity where they provided advisory services within the last year is too restrictive and limiting.

• Standard 10.2 Human Resource Management – “The CAE must establish a program to recruit, develop, and retain qualified internal auditors” may be overly-burdensome.

• Standard 12.1 Internal Quality Assessment – The suggested alternative for small shops “to consider requesting assistance from others within the organization to conduct periodic assessments, such as former internal auditors or others with suitable knowledge of internal auditing” may not be practical.

• Standard 12.2 Performance Measurement– A new standard aiming to build upon accountability of internal audit to both the board and senior management requires the CAE to develop and report on a performance measurement methodology creates more administrative work.

Next Steps

While ACUA members are generally in favor of the modifications to the Standards, there are many details that members feel the IIA should reevaluate. The Auditing and Accounting Principles sub-committee have presented the survey results to the ACUA Board in preparation for the ACUA formal response to the IIA. The committee also encourages individual members to complete their own response to the IIA if desired at: https://www.theiia.org/en/Standards/Standards-Public-Comment/

After reviewing the public comments and making any modifications, the IIA anticipates releasing the new Standards in late 2023. The new Standards become effective 12 months from the release date in late 2024.

Hello ACUA Members!

As the flowers bloom and the Class of 2023 graduates, one can’t help but feel the positive change that is occurring all around us, including changes within the Journal and our profession.

I want to thank former Journal editor Gavin Shubert on his work with the ACUA Journal and wish him the best as he leaves higher education to pursue a career in consulting. As the former Deputy Editor, I have graduated to the role as your new Editor, and I’m looking forward to finding a new Deputy Editor and more article contributors. Feel free to reach out to me with questions, comments, or ideas for future articles at editor@ACUA.org

The Journal is making a positive change to share more information about ACUA committees and members to keep you informed and encourage participation. This issue we highlight the ACUA mentorship program, whose FY23 mentees are about to graduate from the program. We also feature member poll results on hot audit topics, remote working, data analytics software, and more in the Tools and Resources section.

Last March in Denver many members graduated from the new auditor track at Audit Interactive, and seasoned auditors expanded their knowledge. Perhaps there are some new mentors and mentees in that group.

Even the IIA Standards are graduating to the new Global Internal Audit Standards. A big thanks to the Auditing and Accounting Principles sub-committee for gathering member concerns for a formal ACUA response. Learn more about the proposed changes in this issue and submit your concerns to the IIA before May 30^th. I completed their quick online form already.

As this fiscal year comes to an end, I wish you a happy graduation and a positive start to FY24.

Sincerely,
Kara Hefner

Last month the ACUA Journal launched a poll on ACUA Connect to get input from members on a variety of topics so that trends could be shared with the membership. This article summarizes remote work, data analytics, and AuditCon interest. Information on hot audit topics is shared in a separate article in this issue. There were 64 responses from small, medium, and large shops.

Remote Work

Since the pandemic, only 27% of respondents are working in the office every day. The number of hybrid workers make up the majority at 51%, while 22% primarily work from home full time.

For those on a hybrid schedule, 60% come to the office on a set pattern each week. The remainder can be flexible on which days they come in the office, with 22% stating they need to come in for a set number of days.

Data Analytics Software

Auditors are encouraged to incorporate data analytics into their engagements to identify patterns, detect outliers, test entire populations, identify duplicates, and understand the data better. There were 27 respondents who said they used data analytics software outside of Excel, some using multiple products. The most popular software was nearly evenly distributed between ACL, IDEA, PowerBI, Tableau, and IBM Cognos. Some schools were using TeamMate Analytics, and others used Alteryx and ActiveData plugins.

AuditCon Attendance

This year’s AuditCon will be held in sunny Miami from September 24-28. The ACUA Journal asked the 64 respondents whether they plan to attend. While most were unsure at this time, 15 said yes to in person and 3 plan to attend virtually. We hope to see you there.