Internal Audits: Do Higher Ed Institutions Really Need Another Audit?

Today’s colleges and universities are complex organizations, with a scope and scale of activities that dwarfs many other business enterprises. How, then, are those charged with governance expected to execute their fiduciary responsibilities?

With the likelihood of even more oversight from regulators and others, an effective internal audit function can help focus institutional compliance activities and provide the level of assurance boards of trustees expect.

The Institute of Internal Auditors defines internal auditing as, “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” By its very definition, internal audit activity is intended to enhance the organization, not play “gotcha” politics.

Here are three reasons internal audits are vital for institutions of higher education:

1. Risk Assessment: Ask the Pros. Over the past several years, enterprise risk management, or ERM (also referred to as governance, risk and compliance), has been a hot topic on campuses across the country. Initially spurred to action by board members who sat on corporate boards of directors, colleges and universities quickly saw the value of applying the concepts of ERM to their own operations.
Having seen a handful of these implementations first hand, we know from experience that a few institutions did an outstanding job with the risk identification process; others not so much. The successful implementations had a few key elements, including support from the top (board, president, etc.) as well as active involvement of their internal audit resources. This is not to say that internal audit became responsible for the ERM project, for, in fact, in most cases they are not the primary owner. Rather these institutions leveraged the risk assessment and risk identification processes inherent in any well-run internal audit shop to a broader audience and perhaps broader definition of risk.

2. Internal Controls: The Brake or the Gas Pedal? Another concept inherent in the definition of internal audit is the issue of assessing the effectiveness of controls. Internal controls are the bane of many campus administrators. Oftentimes, internal controls are seen as a nuisance, and in the worst cases an impediment to doing the research, instruction or other essential tasks of the institution. But when they are effective and focused on the proper risks, internal controls allow work to flow faster and more freely.
The analogy here is the brake on a car. Why do cars have brakes? The simple answer is so they can stop. But perhaps the better answer is that cars have brakes so they can go faster. Without a brake, cars—or a higher education institution—would be afraid to go fast for fear of hitting something or running afoul of some regulation. With a brake—the effective internal controls—the car can go as fast as it wants knowing that a mechanism exists to exert the correct amount of control when necessary. You see where we’re headed with regard to colleges and universities…

3. Audit Benefits: A Model for Efficiency. A third benefit of internal audit is the role of internal audit in improving efficiency and effectiveness. Through the risk assessment process, and by following a systematic and disciplined approach to their work, internal auditors can compare your operations to best-in-class organizations—whether they are educational institutions or corporate entities.
Take, for example, a large, decentralized research institution, which is likely to have dozens of departments with seemingly duplicative business processes. An internal audit can generate efficiency by allowing those charged with governance to obtain an objective assessment of the institution’s activity, while also assessing the effectiveness of its controls. This may then allow the institution to take the next step, like a service-center approach, drawing upon the most efficient resources to “do more with less” or perhaps to do more with the same.

At a later date, we’ll be writing a post about auditing the auditors: ideas to assess the effectiveness of internal audit operations. For that article, and others examining the most pressing issues facing institutions of higher education and nonprofit organizations, subscribe to the Nonprofit Standard blog.