Services

Accountability Office

UK Internal Audit’s Accountability Office provides continuous evaluation of workplace practices and employee adherence to university regulations related to high-risk processes.

Comprehensive Reviews

Comprehensive reviews are broad-based evaluations of a unit's governance, regulatory compliance, financial integrity, operational effectiveness, asset safeguarding and information security. They help to identify risks and strengthen the unit's overall control environment. 

Investigations

Investigations examine events identified through allegations, data mining or audit activity that may have resulted in a monetary or physical loss to the University. Our investigations team validates the event, quantifies any loss and determines the root cause — the conditions which allowed the event to occur and/or go undetected for a period of time. We ensure that appropriate units within Human Resources, the Office of Legal Counsel, Information Technology Services and the UK Police Department have knowledge of our investigations so that they can take suitable action.

Information Technology Reviews

Our information technology (IT) reviews evaluate technology governance, systems, applications, infrastructure, data and IT-related controls to assess the University's cybersecurity posture and safeguarding of information and technology assets.

IT reviews are conducted both as standalone evaluations and as a component of comprehensive, compliance or investigation reviews.  

Follow-Up Reviews

Follow-up reviews are typically conducted approximately six to 12 months after the initial audit is completed, in accordance with our Work Priorities. However, their actual commencement may vary based on target completion dates of the client’s remediation strategy, as the purpose of these reviews is to validate that the observations noted in the initial review have been resolved.  

Data Analytics

UKIA uses data analytics to compare and analyze large and complex data sets to determine exceptions or detect anomalies based on select criteria. Testing is performed on 100 percent of the population for each of the following analytics, providing the University with greater assurance that concerns are being identified, communicated and appropriately addressed to minimize risk.

Employee Vendor Match (established July 2021)

Review relationships between employee(s) and vendor(s) for compliance.

Software Application Approval (established March 2025)

Review software purchases for adherence to UK procurement protocols (as of December 4, 2023, all software and subscription licenses must be approved by UK Information Technology Services for appropriate evaluation).

Fictitious Employee (established June 2025)

Review SAP/other records for indications of a fictitious employee — names on the payroll who do not provide agreed-upon services for the University.

Repetitive Audits

Our repetitive audits are targeted, narrowly-scoped evaluations of higher-risk administrative and operational processes, such as ProCards, web application security, non-exempt overtime compensation, asset verification and FERPA. The purpose of these reviews is to assess compliance with applicable regulations and University requirements as well as to promote fiscal stewardship. We analyze the results collectively to identify trends and enterprise-wide risks.

Assessments

UKIA performs assessments, or overall evaluations of a unit’s processes and associated technology, to document practices from a risk standpoint. Typically broader in scope than an audit due to the focus on identifying key process risks, UKIA’s assessments are performed as needed due to changes in management, industry trends or other events. They are typically short in duration but can be quite complex, depending on the area being evaluated. The risk areas identified are then used to inform our annual Work Prioritization Plan, according to risk impact and likelihood.

Consultations

Our consultations are mutually agreed-upon engagements that focus on process vulnerabilities and operational opportunities to provide insights and reasonable assurance. We evaluate the unit’s established plans and protocols according to their stated goals and obligations. Managers can then use this guidance to be more proactive in implementing initiatives that increase operational efficiency and effectiveness. 

Lessons Learned

UKIA's hosts educational sessions that leverage insights and trends from our assurance, advisory and accountability activities, as well as emerging issues across higher education and other relevant environments. Our primary resource is Lessons Learned, a web-based training series. More information can be found on the Lessons Learned page or by contacting UKIA directly.