Chapter 3 – Policy Implications for Gaelic - University of Edinburgh

Internal Audit Planning Methodology
b. Where the HEI has a comprehensive risk register, and where these risks clearly link
to business objectives, that register may serve as the audit universe, although the
auditor always retains a professional duty to satisfy him or her self that the list is
comprehensive. Many HEIs limit their risk register to their top 10 or 20 significant
risks and as such operational areas such as payments and receivables might never be
audited. In such cases, the auditor may wish to compile their own audit universe.
c. Where the auditor has compiled the list of auditable entities, it will need to be
annotated to highlight links with key institutional risks identified by the risk
management process. Annotating the document to show previous and potential
future coverage may also assist the auditor, management and the audit committee to
maintain a long-term view of audit coverage within the organisation: although this
will need to stop short of evolving into a long-term Audit Plan.
d. In practice, many of the areas listed will never be audited as they are not considered
material in the level of risk that they pose to the University or because assurance can
be drawn from other sources. For example, academic audit, health and safety
processes.
e. Basing the audits around processes or risks will help ensure the audit takes a holistic
view of how the institution manages its risks. Departmental audits are most likely
to be useful for subsidiaries or other autonomous units that follow their own local
procedures.
f. The institution’s risk management process will be a key driver for the proposed
audit programme and will have particular credibility where the risks identified link
demonstrably to key business objectives.
g. The key risks identified by management may include some topics that Internal Audit
can usefully explore in further detail. Equally, there may well be some risks that do
not lend themselves to audit.
h. The draft Audit Plan will probably be a blend of assignments drawn from the risk
management process, and assignments that relate to the ongoing periodic review of
core operating processes and systems – such as student registration/records, payroll,
debtors, creditors and so on. Risks exist at strategic and operational levels, and
Internal Audit has a role to play in offering assurance at both levels. The balance of
effort between strategic and operating risk is a matter for the internal auditor’s
professional judgement, combined with the expectations of internal and external
stakeholders.
i. The auditor may consider investing resource into the audit of new system projects.
Auditing new applications (and proposed surrounding processes) at the design stage
can help line managers to design-in good control (and avoid the cost of over
control). This can save both management and auditors’ time and cost in the long
run, and ensure systems do not have a period when control is poor.
CUC - Handbook for Members of Audit Committees in Higher Education
Institutions (2008)
14. This handbook provides (non-prescriptive) guidance to help audit committees and stresses
that “practices that work best for one organisation may not be ideal for another”. It states
that: “Internal auditors should adopt a risk based approach when planning their audit
work” and “if they are confident about risk management and if the risk management
arrangements effectively mitigate a risk, then that risk should not merit additional audit
attention.”
Page 14 of 22