The Role of Internal Audit in Higher Education Michael J. McShea, CIA, CFSA, CRMA

1. The Role of Internal Audit in Higher EducationMichael J. McShea, CIA, CFSA, CRMA

2. Today’s presentation can be downloaded at: http://www.wolfandco.com/news/webinar_library

3. About Wolf & Company, P.C. • Established in 1911 • Over 180 professionals with offices located in: • Boston, Massachusetts • Springfield, Massachusetts • Albany, New York • Offers Assurance, Tax, Business Consulting and Risk Management services • Provide services to: • Educational institutions, employee benefit plans, financial institutions, investment management firms, family and closely-held businesses, public companies, professional service firms, technology companies and high net worth individuals

4. Education & Not-for-Profit Expertise • Provide services to a wide range of clients • Public and private educational institutions • Trade associations, religious organizations, fundraising organizations • Foundations • Internal Audit • IT Assurance & Security • Assurance Services • Tax

5. Meet Today’s Presenter Michael J. McShea, CIA, CFSA, CRMASenior Manager – Internal Audit ServicesWolf & Company, P.C Direct: 617-428-5415 mmcshea@wolfandco.com www.wolfandco.com

6. Today’s Agenda • What is Internal Audit? • Types of Internal Audits • Why is it Valuable? • The Internal Audit Process • Example Internal Audit Procedures • Internal or Outsourced Internal Audit Department? • What Effective Departments Offer • Example Risk Assessment • Challenges Faced by Internal Audit • Wrap-Up and Questions

7. What is Internal Audit? “…an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations..” The Institute of Internal Auditors https://na.theiia.org/about-us/about-ia/Pages/About-the-Profession.aspx

8. Types of Internal Audits • There are four major types of internal audits, financial, operating, compliance and information technology - it is not unusual to incorporate elements of each. Internal auditors are sometimes asked to perform special reviews.

9. Why is it Valuable? College town USA

10. Why is it Valuable? • An effective internal audit function can: • Bring subject matter expertise into play • Help focus resources on key operational, financial, and technology activities • Present ideas that challenge existing practices and lead to ongoing business performance improvements • Provide a level of assurance to boards of trustees on the effectiveness of operations

11. The Internal Audit Process The Internal Audit Process

12. The Internal Audit Process • Planning • Preliminary fact-finding discussions with management • Outline audit objectives • Establish audit period and request documentation • Entrance meeting with area to be audited • Execution • Conduct interviews to determine controls and practices • Obtain data for review, analysis and evaluation • Test identified controls

13. The Internal Audit Process • Reporting • Write report • Discuss with management of audited area • Finalize and issue report with recommendations for enhancement • Action Plans • Management formulates responses to correct deficiencies • Follow-up • Management reports on progress to Board and internal audit reviews effectiveness of control remediation

14. Example Internal Audit Procedures Procurement Cards • Review the University’s procurement card-related policies and procedures • Make inquiries of management to document internal controls in place over procurement cards • Document and test the controls in place over: • Issuing and monitoring procurement cards • Approving procurement card transactions • Ensuring transactions are in line with University policies

15. Poll Question!

16. Internal or Outsourced Internal Audit Internally Staffed Outsourced Independent function Perform scheduled audits In-depth review of internal controls Report to Audit Committee Brings Experience from Other Audit Assignments Leverage Knowledge of Firm • Independent function • Perform scheduled audits • In-depth review of internal controls • Report to Audit Committee • Auditing Limited to Employer

17. Internal or Outsourced Internal Audit • Some challenges in building an internally staffed auditing function: • An auditor will seldom have expertise across all of the risk areas that a college or university are likely to have • An auditor with financial expertise is not likely to possess anything beyond a cursory understanding of IT risks • A one or two-person in-house internal audit shop may have difficulty keeping pace with new regulatory, legal and technological developments

18. What Effective Departments Offer • Internal Controls • Assess the effectiveness of controls. Examples: Internal controls help ensure: • Funds and cash receipts are properly accounted for • Building door lock systems and key control access is monitored • Complete and accurate records are kept of transactions involving students • Travel and other expenses are allowable and reasonable

19. What Effective Departments Offer • Efficiency • Internal audit can aid in improving efficiency and effectiveness. Example: An internal audit of a decentralized operation, where duplication may exist, can: • Provide an objective assessment of the activity, while also assessing the effectiveness of its controls. This may then allow the institution to look into ways to streamline or gain efficiency - doing more with less or more with the same.

20. What Effective Departments Offer • Risk Assessment • A risk assessment and risk identification processes should be inherent in any well-run internal audit shop. • A risk assessment would entail examining inherent risk, management's attitude toward internal controls, regulatory pressures, the IT environment, frequency of review, etc. • Upon completing a risk assessment, a rating of low, moderate or high risk is assigned to the assessable unit or area. These ratings are considered when scheduling internal audit reviews.

21. Example Risk Assessment

22. Challenges Faced by Internal Audit • How much to audit • An internal auditor must exercise professional judgment when reconciling the risks with resource limitations and the amount of time available. • How much to communicate • Tell the story as crisply and succinctly as possible. The longer the report, the less likely it will be completely read by those in a position to implement the recommended corrective actions.

23. Challenges Faced by Internal Audit • How to deliver a balanced message • Provide assurance on the overall effectiveness of risk management, control, and governance processes. • Push back • Work with management when they take strong exception to the audit results and conclusions.

24. Wrap-Up and Questions

25. Wrap-Up Internal Audit is a Valuable Tool • Internal auditors can significantly augment management’s oversight capacity and help them prevent weaknesses from becoming problems.

26. Questions? Michael J. McShea, CIA, CFSA, CRMASenior Manager – Internal Audit ServicesWolf & Company, P.C Direct: 617-428-5415 mmcshea@wolfandco.com Today’s presentation can be downloaded at: http://www.wolfandco.com/news/webinar_library