How Do We Decide What to Audit?

Audits are focused on the areas that we believe (for a variety of reasons) pose the greatest risk of financial or other loss to the Campus. An annual risk assessment process is utilized to determine which topics are high risk and may warrant review in the coming year.

These "risk topic areas" of the Campus are identified using a formal methodology called risk assessment. All significant operations of the Campus are scored for six attributes that could indicate risk: management control environment, business volume, public sensitivity, compliance requirements, information reporting, and organizational change.

Some operations of the Campus are considered core business functions and thus important that they get reviewed routinely.