Real-world Internal Audits as Part of the Classroom Experience

1. Real-world Internal Audits as Part of the Classroom Experience Urton Anderson CIA, CCSA, CFSA, CGAPDirector of the Von Allmen School of AccountancyUniversity of KentuckyMark Salamasick CIA, CRMA, CISA, CSPDirector of the Center for Internal Auditing Excellence University of Texas at DallasModified for Internal Audit Faculty Use

2. Objectives of This Presentation • Provide an overview of how we implemented real-world internal audit projects into our classes and our experiences with them. • Illustrate the versatility and practicality of a partnership between academics and internal audit functions of local organizations. • Provide examples of how real-world audit projects have been implemented at UT Austin and UT Dallas. • Outline the responsibilities of sponsors and students who participate in the project. • Examine how implementing real-world audit projects can be a “Win-Win” for students and the internal audit function. • Consider the potential challenges that must be addressed with the project sponsor. • Provide real-world audit project best practices for both faculty members and participating CAEs. 2

3. Overview of Experience Implementing Real-world Audit Projects • The Management and Control class at UT Austin has integrated real-world internal audit projects into the class since 1991, and the Internal Audit class at UT Dallas has been including these projects in the class since 2003. • More than 450 real-world audit projects have been completed at UT Austin, and more than 200 have been completed at UT Dallas. • Both classes have completed audits in conjunction with university auditors, government organizations, nonprofits, and audit groups of for-profit organizations. • Organizations we have worked with will have benefited from the audit work of the students and many have hired students who have worked on the student audits. 3

4. Types of Audits Performed • Cash Handling • Travel and Expense • Procurement • Departmental Audits • Construction • Compliance • IT General Controls • Information Security • Telecommunications • Third-party Contracts • Ethics • Internal Controls Over Financial Reporting 4

5. The Purpose of Using Real-world Audit Projects in the Internal Audit Class To help students reinforce and expand their learning experience. This should lead to: • Opportunities to apply academic learning. • Greater understanding of business processes. • Integrated learning about how specific projects relate to larger business goals. • Deeper understanding of the importance of communication skills in the professional world. • Increased understanding of the importance of positive personal interactions to business success at all levels. • Students’ ability to make future career/employment choices that align with their individual personal interaction styles and abilities.

6. How Did We Get Started? • The first thing we did was meet with the Chief Audit Executive of our respective universities to discuss the idea of having students perform real-world audits with our universities’ internal audit functions. • Then we discussed the plan for the semester with the CAE to determine the specific potential audits and the number of students that would be involved. • Finally, we identified potential audit sponsors from outside the universities who were willing to work with students. 6

7. Sponsors Are Expected To: • Support and develop students: • As much as practical, work assigned to students should align with their specific area of study (for example, accounting majors should be assigned accounting-related work). • Provide hands-on experience to students: • 40 to 80 hours per team member. • 300 to 400 hours per team. • 3 to 5 students per team. • Provide training and supervision: • The IIA’s International Professional Practices Framework, particularly theCode of Ethics. • Risk methodologies. • Internal audit techniques (for example, workpapers, interviewing, process mapping, use of control frameworks and models). • Provide a post-project evaluation for each student.

8. Responsibilities of Participants IA Project Supervisor (IA function staff member or manager) • Supervise student team. • Review risk assessment performed by student auditors. • Review audit/engagement program created by student auditors. • Review workpapers created by student auditors. • Review audit report drafted by student auditors. • Issue report to board and management.

9. Responsibilities of Participants Student team(audit of process or activity) • Obtain understanding of process/activity and identify goals and objectives (for example, budget, legal requirements, performance measurements, etc.). • Work with the internal audit function to complete preliminary survey, risk assessment, and annual assurance audit plan. • Conduct appropriate audit work in high-risk areas. • Document risk assessment and audit work in working papers. • Prepare draft of report. • Present report to area/process management. Note: The sponsor may not require all of these steps on each project.

10. Responsibilities of Participants Student team (risk assessment) • Identify Mission, Goals, and Objectives. • Brainstorm activities. • Consolidate into processes. • Prioritize processes. • Brainstorm risks for each process. • Assign impact and likelihood values. • Create the risk map. Note: The sponsor may not require all of these steps on each project.

11. Project Timeline (Example) • Interview students and assign project teams (week 2) • Engagement letter (week 4 of semester) • Written preliminary planning of audit (week 6) • Audit/engagement program (week 9) • Draftreport (week 14) • Closing conference (weeks 15) • Final report and presentation to class (week 16) Note: Time frames may be compressed, if necessary.

12. Student Deliverables to the Internal Audit Function • Preliminary planning • Engagement letter • Process map • Risk/control map • Risk/control matrix • Audit program • Working papers • Identified control deficiencies and recommendations • Closing conference agenda • Final written report Note: The sponsor may not require all of these deliverables on each project.

13. Executing the Real-world Audit Project Introduce Project to the Students • Introduce the project early in the semester — preferably the second class meeting. • Invite the CAEs (or designee) of participating audit functions to present to the class: • Brief summary of their internal audit department’s organization, staff, audit committee • Outline of their annual audit plan • Outline of their risk assessment • Overview of their audit planning and how it ties to the annual audit plan • Description of their audit working papers • Students give 30-second “elevator” speeches about themselves. • Formal interviews can be held the following week. Matches of students to internal audit functions are announced the afternoon of interviews. • Schedule of deliverables given to students.

14. Executing the Real-world Audit Project Assign Teams • Determine teams based on student strengths: • Experience • Business • Accounting • Information Systems • Audit • Specialties (Engineering, Food Service, etc.) • Language fluencies • Interest • Time constraints and work schedules • Assign teams of 3-5 students and discuss preliminary project plan. • Identify one student on the team as the in-charge auditor: • Co-in-charge auditors can be chosen if more than one student has the appropriate experience or expertise.

15. Executing the Real-world Audit Project Plan the Audit • Assign students to audit planning activities, such as: • Notify auditees of the audit. • Create time budgets. • Create a planning memo. • Research audit areas. • Gather preliminary information. • Attend planning meeting. • Assign students to review prior year working papers and the Internal Audit Manual (or equivalent). • Assign students to complete the audit program and submit it to the IA project supervisor for approval. • Assign students to complete sections of the audit program as their schedules permit.

16. Executing the Real-world Audit Project Monitor the Audit • Monitor the schedule of deliverables for the semester weekly and ask students to share team progress with the class each week. • Require regular communication between the faculty member and the assigned in-charge via e-mail and face-to-face meetings. • Require audit teams to submit weekly status reports that include time tracking to the IA project supervisor.

17. Executing the Real-world Audit Project Report Project Results • Require students to draft the audit report. • Students should attend exit conference, if possible. • Request that credit for conducting the audit work be given to students in the Executive Summary (or equivalent) section of the audit report.

18. Executing the Real-world Audit Project Determine Grades • At the end of the semester, discuss student performance with members of the internal audit function and the IA project supervisor to obtain input for student grades. • Encourage students to ask the IA project supervisor if he or she would be willing to serve as a reference for students when they apply for jobs in the future. • An easy rule of thumb for grading can be something like, 90 and above if they would hire the student if they had an opening, 80 to 89 if there were some deficiencesbut might consider hiring the student, 70 to 79 if the students had significant issues, 69 or less they would be fired from the audit

19. Why the Real-world Audit Project is a“Win-Win” for All Benefits for the Students • Students get real-life internal audit experience. • Students have the opportunity to polish professional skills like communication, organization, and time management. • Concepts taught in the classroom are reinforced through hands-on experience. • Students gain a new perspective on organizational operations. • High-quality performance on the project reflects well on students and can help build their resume.

20. Why the Real-world Audit Project is a“Win-Win” for All Benefits for the Internal Audit Function • Provides an opportunity for staff auditors to serve in a supervisory role as they mentor students. • High-performing students can be recruited to serve in open staff positions. • Provides additional resources to complete or possibly expand audit coverage outlined in the internal audit plan. • Students may offer new perspectives and different ways of looking at things. • There is no incremental financial cost involved.

21. Potential Challenges • Initial cost in time to train students • Students’ limited internal audit experience • Student workloads, schedules, full-time employment • Risk to confidential information • Audits have to begin and end with the semester • Limited time to train and supervise students • Audit group may be reluctant to give responsibilities to students • Students’ communication skills may need refining Note: All of these challenges can be overcome with proper up-front planning and coordination with the project sponsors.

22. Best Practices to Help Address Challenges For Faculty • Create an environment of excitement. • Provide up-front training, guidelines, and due dates. • Get 100% buy-in from internal audit functions and audit committees. • Profile students and play to their particular strengths. • Meet often and keep control of the audits (preferably weekly). • React quickly to students who are not performing. • Work with the project sponsor to adjust teams as needed. For the Project Sponsor • Have students sign nondisclosure agreements for sensitive audit areas. • Involve students in all phases of the audit. • Give students the freedom to develop risk assessments and audit programs and execute the work program. • Meet often and keep control of the audits (preferably weekly). • React quickly to students who are not performing. • Work with the faculty member to adjust teams as needed.

23. Questions? Mark Salamasick University of Texas at Dallas Mark.Salamasick@utdallas.edu jsom.utdallas.edu/centers/iaep 972-883-4729 Urton Anderson University of Kentucky urton.anderson@uky.edu