Audits

Internal Audit helps the University in addressing fraud by determining the adequacy and effectiveness of internal controls, although management and the Council are ultimately responsible for fraud deterrence.

Services provided

• initial or full investigation of suspected fraud
• proactive auditing to search for fraud
• root cause analysis and control improvement recommendations
• monitoring of reporting hotline
• providing ethics training sessions.

To the degree that fraud may be present in activities covered in the normal course of audit work, the Standards state that internal auditors have the following responsibilities with respect to fraud detection.

• Due Professional Care (Standard 1220)
• Risk Management (Standard 2120)
• Engagement Objectives (Standard 2210).

Audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected. In conducting audit engagements, the internal auditor will,

• consider fraud risks in the assessment of internal control design and determination of audit steps to perform. Internal auditors are not expected to detect fraud, but internal auditors are expected to obtain reasonable assurance that business objectives for the process under review are being achieved and material control deficiencies whether through simple error or intentional effort are detected. The consideration of fraud risks is documented in the workpapers, as well as linkage of fraud risks to specific audit work
• have sufficient knowledge of fraud to identify red flags indicating fraud may have been committed. This knowledge includes the characteristics of fraud, the techniques used to commit fraud, and the various fraud schemes and scenarios associated with the activities reviewed
• be alert to opportunities that could allow fraud, such as control deficiencies. If significant control deficiencies are detected, additional tests conducted by internal auditors could be used to identify whether fraud has occurred
• evaluate whether management is actively retaining responsibility for oversight of the fraud risk management program, that timely and sufficient corrective measures have been taken with respect to any noted control deficiencies or weaknesses, and that the plan for monitoring the program continues to be adequate for the program’s ongoing success
• evaluate the indicators of fraud and decide whether any further action is necessary or whether an investigation should be recommended
• recommend investigation when appropriate. 

For further assistance, contact the Manager (Audit and Risk).