Internal Audit

1. Introduction

The Institute of Internal Auditors defines internal audit as “an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

Standard 2500 of the International Standards for the Professional Practice of Internal Auditing (‘the Standards’), requires that “The chief audit executive [EY] must establish and maintain a system to monitor the disposition of results communicated to management.” Standard 2500.A1 requires “The chief audit executive [EY] must establish a follow-up process to monitor and ensure that internal audit actions have been effectively implemented or that senior management has accepted the risk of not taking action.”

The University’s internal audit services are outsourced providing independence and impartiality. Ernst & Young (EY) is contracted until December 2024 and uses the “EYVIA” platform to record, monitor and report on outstanding internal audit actions.

In addition, Standard 2600 requires that “When the chief audit executive [EY] concludes that management has accepted a level of risk that may be unacceptable to the organization, the chief audit executive [EY] must discuss the matter with senior management. If the chief audit executive [EY] determines that the matter has not been resolved, the chief audit executive [EY] must communicate the matter to the board [Risk Committee].”

These standards form the basis for the procedure used by the University of Adelaide to close open internal audit actions.

2. Recording and tracking internal audit actions

A significant amount of time is committed to an internal audit engagement, and a clear and actionable audit observation is critical to communicate issues noted during the engagement. Audit observations provide management, the Risk Committee, and stakeholders with an objective summary of the University’s operations, risks, and controls, as well as a summary of the audit work performed. Audit observations are how internal audit communicates audit results. When gaps are identified, the internal audit suggests appropriate actions to improve the organization’s processes.

Audit actions describe a desirable change required to address a key risk. These actions are provided to assist management address weaknesses or deficiencies within internal controls to mitigate key risks. Management can and should challenge both the gap and the action, based on evidence and analysis. The auditor will respond to such challenges and the final audit report should have a high degree of support from both management and auditors. The final audit report will include management comments that highlight management’s commitment to action, assign accountabilities and set target completion dates.

Accountabilities and timeframes assigned to audit actions should be clearly communicated before the finalization of the Internal audit report to ensure timeframe and assignment are understood by all parties.

Each audit finding has a risk rating as per the University Risk Matrix. Risk ratings are based on likelihood and consequence assessments, the criteria for which have been agreed with management. The risk rating indicates the potential risk impact on the category of risk and describes the management action required as defined by the University’s Risk Management Framework. The purpose of the risk ratings is to highlight the seriousness of the finding and to help management with prioritisation.

Tracking audit actions holds management accountable for following through on the commitments made. Being mindful that systems and operating contexts constantly evolve, the aim is to ensure that the underlying risk and deficiency are corrected. As such, management has the discretion to address the risk and deficiency in ways different from the auditor’s action.

3. Improvement opportunities

As part of the internal audit engagement, improvement opportunities may be identified. Such opportunities will be included in the internal audit report and can be considered as valuable feedback to the business. While efforts should be made to take these into consideration, management comments, accountability and target completion dates will not be set in the audit report, nor will they be tracked in EYVIA.

4. Standard and exceptional closing process

The following table illustrates the difference between what internal audit would consider standard reasons for closing open actions versus what would be considered non-standard or exceptional reasons for closing actions. Closing requests for exceptional reasons will need to be appropriately justified and escalated to the Chief Risk Officer and Risk Committee.

Requests for closing open internal audit actions for reasons other than the above are not considered sufficient grounds for closing open actions. Examples include but are not limited to:

• Too much time has passed. Management is still expected to demonstrate that the finding no longer has any rationale or that the underlying risk has been addressed.
• Commitment to a future change that will address the issue. This can be a valid reason to postpone the target completion date of the action but requires evidence of strong progress towards implementation of the change.
• Change of responsible manager or a broader restructure. This does not in itself result in the issue being resolved and as such is not sufficient grounds for closing the open action.
• Inadequate resources, funding, or management support for implementation. Such factors can be legitimate, however, escalation of decision-making regarding action closure will be required.

4.1. Standard process

The standard closing process is commonly applied where the evidence supports that the risk highlighted in the original finding has been satisfactorily addressed or where circumstances have changed to the extent that the original risk or action is no longer relevant. This process is managed by the internal audit team, in accordance with the internal protocols and processes outlined below.

• Action owners are allocated to each individual action within EYVIA and will be prompted by internal audit or Risk Services to provide feedback and evidence regarding the implementation of the agreed action.
• Requests to close open actions must always be supported by evidence, explanations, and documentation. Internal audit is responsible for assessing the information and documentation provided before closing the action in EYVIA.
• Decisions regarding closing more significant actions may be escalated to Risk Services for discussion and approval.
• Internal audit together with Risk Services monitor open actions on a quarterly basis and report accordingly to the Risk Committee.

EY has prepared an action owner user manual to assist in navigating the EYVIA system.

4.2. Exceptional process

In unusual and exceptional cases, management may approach internal audit to request closing open actions, despite them not having been resolved. The Area Manager responsible (i.e., meaning Deputy Vice-Chancellors and Vice Presidents; Pro Vice-Chancellors; Executive Deans; Executive Director, Human Resources; Chief Executive, External Relations (and a person acting in these positions); and Institute Directors, as defined in the University of Adelaide Enterprise Agreement 2023 - 2025 is required to confirm in writing to internal audit and Risk Services that they are supportive of accepting the underlying risk and proposing closing the open action. In assessing the appropriateness of a request to close an unresolved action, the Area Manager should consider if the argumentation is genuine and valid and whether key University stakeholders (including the Risk Committee) would be satisfied with the decision to continue with the deficiency leading to the action.

Internal audit and Risk Services will consider the proposal, in the context of the following:

• Other actions already completed relating to the same audit finding and risk,
• Changes in circumstances,
• The cost of addressing an audit finding in relation to the benefits,
• Whether the open action relates to a key control[1] or has University-wide implications (e.g., a systemic issue),
• The risk rating of the finding that the open action relates to, and
• How the open action relates to the University’s Risk Appetite.

Exceptional closing requests where risks are not considered unacceptable should be supported by the Chief Risk Officer, and reported to the Risk Committee. If the Chief Risk Officer assesses that closing the open action will result in the acceptance of a level of risk that may be unacceptable to the University, the request will be presented for decision at the Risk Committee by the Area Manager. Closing actions must always be properly supported and justified, including evidence of management’s acceptance of the underlying risk.

5. Requests for a revision of the target completion date

If management is unable to meet a previously agreed target completion date, only the Risk Committee may approve a revision of the agreed target completion date. A justification and plan of action highlighting the commitment by management to implement the action needs to be provided. Internal audit together with Risk Services will facilitate the request for extension to be reported to the Risk Committee. The implementation of internal audit actions is an integral part of the internal audit process and allows management to address weaknesses or deficiencies within internal controls to mitigate key risks. As such, revisions of target completion dates should only be used in exceptional cases. If a revision of the target completion date is requested more than twice for the same action, the Area Manager will need to present it to the Risk Committee to obtain approval for such a request.

6. Other strategies to improve the closing process

6.1. Improvement plan

In exceptional cases where the nature of the observations made in the Internal audit report is predominantly strategic, with internal assessments ongoing and several recommended actions in response to both the findings and improvement opportunities noted, the internal audit may decide to not seek individual management responses to each action. In such cases, an overarching recommendation may be made to management to translate the actions into a combined ‘Improvement Plan’ that brings together the internal audit actions with those from the internal assessment.

This will support the University with a more considered response plan that more systematically uplifts maturity, reduces compliance risk, and enhances clarity for everyone involved. Usually, it will be recommended for the Improvement Plan to be overseen by an appropriate governance structure within the University, with Executive ownership, and that resourcing requirements to support the Improvement Plan are determined. Once developed, the Improvement Plan should be presented to the University’s Risk Committee by the Internal audit sponsor for visibility and the actions from the internal audit report will be monitored as per usual procedures.

We note, that this is not a standard approach and will only be utilized in specific situations.

6.2. Setting reasonable timeframes

The internal audit aims to work with the business to set reasonable timeframes for the completion of actions arising from internal audits. Management is encouraged to carefully consider the reasonability and feasibility of the timeframes proposed at the time of finalization of the report.

6.3. Resources

A common barrier to closing open audit actions is funding and resourcing. Management is therefore recommended to carefully consider staffing and budget implications to assess the realism of proposed internal audit actions and timeframes. Management should actively consider agreed commitments regarding open audit actions when establishing annual budgets.