Risk Assessment
The purpose of the risk assessment is to develop an audit plan for performing audit projects in risk areas over a specified time in order to:
- minimize the risk of losses to the University
- prioritize audit projects by the level of risk
- utilize audit staff and time in an effective and efficient manner
- determine the nature, timing, and extent of audit steps and procedures in direct relation to the amount and nature of the risk
The risk assessment consists of three phases:
Identify auditable entities
We review the University structure to identify academic and administrative units. We evaluate organizational charts and financial information in order to determine how to organize the units into auditable entities. We also identify processes which apply to all departments such as payroll, meals and entertainment.
Conduct interviews
We interview the director, chair or manager of each auditable entity utilizing a standardized questionnaire. Some interviews cover multiple entities as certain individuals oversee multiple departments or functions.
Analyze information and develop a risk matrix
After completing each interview, we utilize responses to the questionnaire to rate each entity based on twelve risk factors. We also analyze financial information and research applicable policies and regulations. The risk factors include:
- Dollar volume and number of transactions
- Quality of internal controls
- Executive management interest
- Results of prior audits
- Changes in personnel, procedures, regulations, or systems
- Complexity of activity
- Public and political sensitivity
- Time since last audit (internal or external)
- Deviations from budget or plan
- Compliance with SBOE/Institution policies and procedures, laws, and regulations
- Audit required by regulatory agencies
- Inherent risk of misappropriation of assets – cash, equipment, etc.
The risk factors for a given entity are assigned weights from 1 (less significant) to 5 (more significant) based on a standardized rating scale. The sum of the weights determine the total risk score for each entity.
Audit projects are scheduled based on the highest risk entities. The risk assessment is updated annually as part of the audit planning process.