1. MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS © 2010 Wolf & Company, P.C. The Role of Internal Audit in Higher Education Michael J. McShea, CIA, CFSA, CRMA

2. Today’s presentation can be downloaded at: http://www.wolfandco.com/news/webinar_library 2

3. About Wolf & Company, P.C. Established in 1911 Over 180 professionals with offices located in: –Boston, Massachusetts –Springfield, Massachusetts –Albany, New York Offers Assurance, Tax, Business Consulting and Risk Management services Provide services to: –Educational institutions, employee benefit plans, financial institutions, investment management firms, family and closely-held businesses, public companies, professional service firms, technology companies and high net worth individuals 3

4. Education & Not-for-Profit Expertise Provide services to a wide range of clients –Public and private educational institutions –Trade associations, religious organizations, fundraising organizations –Foundations Internal Audit IT Assurance & Security Assurance Services Tax 4

5. Meet Today’s Presenter Michael J. McShea, CIA, CFSA, CRMA Senior Manager – Internal Audit Services Wolf & Company, P.C Direct: 617-428-5415 mmcshea@wolfandco.com www.wolfandco.com 5

6. Today’s Agenda What is Internal Audit? –Types of Internal Audits Why is it Valuable? The Internal Audit Process –Example Internal Audit Procedures –Internal or Outsourced Internal Audit Department? What Effective Departments Offer –Example Risk Assessment Challenges Faced by Internal Audit Wrap-Up and Questions 6

7. What is Internal Audit? “…an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations..” The Institute of Internal Auditors https://na.theiia.org/about-us/about-ia/Pages/About-the-Profession.aspx 7

8. Types of Internal Audits There are four major types of internal audits, financial, operating, compliance and information technology - it is not unusual to incorporate elements of each. Internal auditors are sometimes asked to perform special reviews. 8

9. Why is it Valuable? 9 College town USA

10. Why is it Valuable? An effective internal audit function can: –Bring subject matter expertise into play –Help focus resources on key operational, financial, and technology activities –Present ideas that challenge existing practices and lead to ongoing business performance improvements –Provide a level of assurance to boards of trustees on the effectiveness of operations 10

11. The Internal Audit Process 11 The Internal Audit Process

12. Planning –Preliminary fact-finding discussions with management –Outline audit objectives –Establish audit period and request documentation –Entrance meeting with area to be audited Execution –Conduct interviews to determine controls and practices –Obtain data for review, analysis and evaluation –Test identified controls 12

13. The Internal Audit Process Reporting –Write report –Discuss with management of audited area –Finalize and issue report with recommendations for enhancement Action Plans –Management formulates responses to correct deficiencies Follow-up –Management reports on progress to Board and internal audit reviews effectiveness of control remediation 13

14. Procurement Cards –Review the University’s procurement card-related policies and procedures –Make inquiries of management to document internal controls in place over procurement cards –Document and test the controls in place over:  Issuing and monitoring procurement cards  Approving procurement card transactions  Ensuring transactions are in line with University policies 14 Example Internal Audit Procedures

15. Poll Question! 15

16. Internal or Outsourced Internal Audit Internally Staffed Independent function Perform scheduled audits In-depth review of internal controls Report to Audit Committee Auditing Limited to Employer Outsourced Independent function Perform scheduled audits In-depth review of internal controls Report to Audit Committee Brings Experience from Other Audit Assignments Leverage Knowledge of Firm 16

17. Internal or Outsourced Internal Audit Some challenges in building an internally staffed auditing function: –An auditor will seldom have expertise across all of the risk areas that a college or university are likely to have –An auditor with financial expertise is not likely to possess anything beyond a cursory understanding of IT risks –A one or two-person in-house internal audit shop may have difficulty keeping pace with new regulatory, legal and technological developments 17

18. Internal Controls –Assess the effectiveness of controls. Examples: Internal controls help ensure: –Funds and cash receipts are properly accounted for –Building door lock systems and key control access is monitored –Complete and accurate records are kept of transactions involving students –Travel and other expenses are allowable and reasonable 18 What Effective Departments Offer

19. Efficiency –Internal audit can aid in improving efficiency and effectiveness. Example: An internal audit of a decentralized operation, where duplication may exist, can: –Provide an objective assessment of the activity, while also assessing the effectiveness of its controls. This may then allow the institution to look into ways to streamline or gain efficiency - doing more with less or more with the same. 19 What Effective Departments Offer

20. Risk Assessment –A risk assessment and risk identification processes should be inherent in any well-run internal audit shop. –A risk assessment would entail examining inherent risk, management's attitude toward internal controls, regulatory pressures, the IT environment, frequency of review, etc. –Upon completing a risk assessment, a rating of low, moderate or high risk is assigned to the assessable unit or area. These ratings are considered when scheduling internal audit reviews. 20

21. Example Risk Assessment 21 Threat Risk Impact Operational AreasProcesses Likelihood ReputationStrategicSafetyAvailabilityITVendorRegulatoryFinancial Human ResourcesPayroll Moderate LowModerateLowModerateHighLowHighModerate Inherent Risk Assessment KeyAudit Timeframe High12 months Moderate24 months Low36 months Inherent Risk:Moderate

22. Challenges Faced by Internal Audit How much to audit –An internal auditor must exercise professional judgment when reconciling the risks with resource limitations and the amount of time available. How much to communicate –Tell the story as crisply and succinctly as possible. The longer the report, the less likely it will be completely read by those in a position to implement the recommended corrective actions. 22

23. Challenges Faced by Internal Audit How to deliver a balanced message –Provide assurance on the overall effectiveness of risk management, control, and governance processes. Push back –Work with management when they take strong exception to the audit results and conclusions. 23

24. Wrap-Up and Questions 24

25. Wrap-Up Internal Audit is a Valuable Tool Internal auditors can significantly augment management’s oversight capacity and help them prevent weaknesses from becoming problems. 25

26. Questions? Michael J. McShea, CIA, CFSA, CRMA Senior Manager – Internal Audit Services Wolf & Company, P.C Direct: 617-428-5415 mmcshea@wolfandco.com Today’s presentation can be downloaded at: http://www.wolfandco.com/news/webinar_library 26