Services

Accountability Office

UK Internal Audit’s Accountability Office provides continuous evaluation of workplace practices and employee adherence to university regulations related to high-risk processes. Click here to learn more.

Comprehensive Reviews

Comprehensive reviews utilize the Committee of Sponsoring Organizations (COSO) and Control Objectives for Information and Related Technologies (CoBIT) frameworks to provide reasonable assurance to UK’s Board of Trustees and senior management regarding the following:

• Compliance with applicable laws and regulations
• Integrity of financial reporting
• Safeguarding of assets
• Operational efficiency and effectiveness
• Governance

For each comprehensive review, the full scope is not determined until after UKIA completes the planning phase during which time the risks most likely to impede the attainment of UK’s objectives are identified. Appropriate and sufficient work allows us to assess business practices, evaluate the internal control environment and trend data to provide value-added insights and recommendations to both the client and relevant stakeholders (process owners).  

Investigations

UKIA’s investigations team examines events that may have led to a monetary or physical loss to the university to validate the event, accurately calculate the resulting loss and determine the root cause — the conditions which allowed the event to occur and/or go undetected for a period of time. We ensure that appropriate units within Human Resources, the Office of Legal Counsel, Information Technology Services and the UK Police Department have knowledge of our investigations so that they can take suitable action.

These investigations typically stem from information provided through the following sources: tips (UK’s anonymous reporting sources, direct calls to UKIA) and auditor observations.

Information Technology Reviews

Information Technology (IT) reviews utilize the CoBIT framework to evaluate the quality of the controls and safeguards over the information technology resources at the university. The objectives of IT reviews are to ensure the following:

• The effectiveness and efficiency of university IT resources
• The integrity of all UK data and data systems
• Adherence to UK policies and procedures
• Proper controls are in place to protect computer applications and the computing environment.

IT reviews are conducted both as a standalone evaluation and as a component of Comprehensive, Compliance or Investigation reviews.  

Follow-Up Reviews

Follow-up reviews are typically conducted approximately six to 12 months after the initial audit is completed, in accordance with the Work Prioritization Plan. However, their actual commencement may vary based on target completion dates of the client’s remediation strategy, as the purpose of these reviews is to validate that the observations noted in the initial review have been resolved.  

Data Analytics

Data analytics is used to compare and analyze large and complex data sets to determine exceptions or detect anomalies based on select criteria.

Repetitive Auditing Programs

Our repetitive auditing programs examine areas at high risk for non-compliance, such as ProCards, web application security, non-exempt overtime compensation, asset verification and FERPA. The purpose of these reviews is to assess clients’ practices for compliance with federal regulations and university procedures, though they also support the detection of fraudulent activity at the individual employee level.

Assessments

UKIA performs assessments, or overall evaluations of a unit’s processes and associated technology, to document practices from a risk standpoint. Typically broader in scope than an audit due to the focus on identifying key process risks, UKIA’s assessments are performed as needed due to changes in management, industry trends or other events. They are typically short in duration but can be quite complex, depending on the area being evaluated. The risk areas identified are then used to inform our annual Work Prioritization Plan, according to risk impact and likelihood.

Consultations

UKIA’s “big picture” analysis pinpoints units’ strengths and weaknesses and provides unit management with valuable insights and key benchmarks related to their functional responsibility(s) and/or high-risk administrative processes. The unit’s established plans and protocols are evaluated according to their stated goals and obligations. Managers can then use this guidance to be more proactive in implementing initiatives that increase operational efficiency and effectiveness. Consultations are performed at the unit’s request and the nature and scope are agreed upon in advance by the unit.

Lessons Learned

Lessons Learned are WBTs which share insights gleaned from audit activity and current events both here and across the nation.  More information can be found on the Lessons Learned page or by contacting UKIA directly.